test(e2e): fix revoke empty-list crash and password-restore CSRF cascade

Two CI-only failures surfaced against a fresh backend DB:

- The revoke test read after.data.find(), but the list endpoint omits data
  entirely when the admin has zero tokens, throwing on undefined. Default to [].
- The password-change test's restore POST hit a 403: changing the password
  triggers a refresh-token that re-mints the nz-csrf cookie, so the X-CSRF-Token
  read just before the request can be stale. A failed restore left the admin on
  the rotated password and cascaded into cron/fm/visibility login failures.
  Add csrfRequest(), which retries once on 403 after re-reading the cookie, and
  use it for both profile mutations.

Verified 8/8 passing across repeated fresh-DB CI-mode runs.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

tests/e2e/api-tokens.spec.ts

@@ -58,8 +58,11 @@ test("admin can revoke an API token via UI revoke button", async ({ page }) => {
 
     await expect(row).toHaveCount(0)
 
+    // The list endpoint omits `data` entirely when the admin has zero tokens,
+    // so default to [] before searching for the revoked id.
     const after = await page.request.get("/api/v1/api-tokens").then((r) => r.json())
-    expect(after.data.find((t: { id: number }) => t.id === tokenID)).toBeUndefined()
+    const tokens: Array<{ id: number }> = after.data ?? []
+    expect(tokens.find((t) => t.id === tokenID)).toBeUndefined()
 })
 
 test("an API token can authenticate /mcp", async ({ page }) => {

tests/e2e/auth.spec.ts

@@ -1,6 +1,6 @@
 import { expect } from "@playwright/test"
 
-import { csrfHeaders, defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
+import { csrfRequest, defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
 
 test("login persists session via cookie and getProfile succeeds", async ({ page }) => {
     await loginAs(page, defaultAdmin)
@@ -17,8 +17,7 @@ test("password change rotates TokenVersion and revokes existing session", async
     const newPassword = `e2e-${Date.now().toString(36)}`
     let isOnNewPassword = false
     try {
-        const resp = await page.request.post("/api/v1/profile", {
+        const resp = await csrfRequest(page, "post", "/api/v1/profile", {
-            headers: await csrfHeaders(page),
             data: {
                 original_password: defaultAdmin.password,
                 new_password: newPassword,
@@ -44,8 +43,7 @@ test("password change rotates TokenVersion and revokes existing session", async
         if (isOnNewPassword) {
             await page.context().clearCookies()
             await loginAs(page, { username: defaultAdmin.username, password: newPassword })
-            const restoreResp = await page.request.post("/api/v1/profile", {
+            const restoreResp = await csrfRequest(page, "post", "/api/v1/profile", {
-                headers: await csrfHeaders(page),
                 data: {
                     original_password: newPassword,
                     new_password: defaultAdmin.password,

tests/e2e/fixtures.ts

@@ -48,6 +48,29 @@ export async function csrfHeaders(page: Page): Promise<Record<string, string>> {
     return { "X-CSRF-Token": value }
 }
 
+// csrfRequest issues a mutating request with the X-CSRF-Token header, retrying
+// once if the backend re-mints the nz-csrf cookie between read and send. A
+// password change triggers a refresh-token that rotates the cookie, so a single
+// read can race the new value and 403; re-reading on 403 closes that window.
+export async function csrfRequest(
+    page: Page,
+    method: "post" | "patch" | "delete" | "put",
+    url: string,
+    options: { data?: unknown; failOnStatusCode?: boolean } = {},
+): Promise<import("@playwright/test").APIResponse> {
+    let resp = await page.request[method](url, {
+        ...options,
+        headers: await csrfHeaders(page),
+    })
+    if (resp.status() === 403) {
+        resp = await page.request[method](url, {
+            ...options,
+            headers: await csrfHeaders(page),
+        })
+    }
+    return resp
+}
+
 export async function expectAuthenticated(page: Page) {
     const resp = await page.request.get("/api/v1/profile")
     expect(resp.status(), "profile must respond 2xx while authenticated").toBeLessThan(400)