feat(api-tokens): add PAT management UI, CSRF handling, and auth-loading fixes

Add an API tokens management route to create, list, and revoke PATs, showing
the plaintext token once on creation with scope and server-id selection.

Mirror the nz-csrf cookie into the X-CSRF-Token header on unsafe fetcher
methods (POST/PUT/PATCH/DELETE) for the server-side double-submit check, and
self-heal expired sessions via refresh-token without a recursive fetch loop.

Gate protected routes behind resolved auth state to avoid pre-auth SWR fetches,
and fix the login loading/race so stale probes cannot clobber the session.

Add i18n keys for the new screens across all locales.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

src/components/settings-tab.tsx

@@ -8,10 +8,11 @@ export const SettingsTab = ({ className }: { className?: string }) => {
     const { profile } = useAuth()
 
     const isAdmin = profile?.role === 0
+    const colsClass = isAdmin ? "grid-cols-5" : "grid-cols-1"
 
     return (
         <Tabs defaultValue={window.location.pathname} className={className}>
-            <TabsList className="grid w-full grid-cols-4">
+            <TabsList className={`grid w-full ${colsClass}`}>
                 {isAdmin && (
                     <>
                         <TabsTrigger value="/dashboard/settings" asChild>
@@ -28,6 +29,9 @@ export const SettingsTab = ({ className }: { className?: string }) => {
                         </TabsTrigger>
                     </>
                 )}
+                <TabsTrigger value="/dashboard/settings/api-tokens" asChild>
+                    <Link to="/dashboard/settings/api-tokens">{t("ApiTokens")}</Link>
+                </TabsTrigger>
             </TabsList>
         </Tabs>
     )