feat(api-tokens): add PAT management UI, CSRF handling, and auth-loading fixes

Add an API tokens management route to create, list, and revoke PATs, showing
the plaintext token once on creation with scope and server-id selection.

Mirror the nz-csrf cookie into the X-CSRF-Token header on unsafe fetcher
methods (POST/PUT/PATCH/DELETE) for the server-side double-submit check, and
self-heal expired sessions via refresh-token without a recursive fetch loop.

Gate protected routes behind resolved auth state to avoid pre-auth SWR fetches,
and fix the login loading/race so stale probes cannot clobber the session.

Add i18n keys for the new screens across all locales.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

src/locales/zh-TW/translation.json

@@ -219,5 +219,30 @@
         "StatusFailed": "已失敗",
         "StatusTimeout": "已逾時",
         "StatusCancelled": "已取消"
-    }
+    },
+    "EnableMCP": "啟用 MCP 端點（預設關閉；啟用前請先檢查 API token 範圍與伺服器允許清單）",
+    "ApiTokens": "API Token",
+    "CreateApiToken": "建立 API token",
+    "CreateApiTokenDescription": "Token 會代表你對 MCP 與外部用戶端進行驗證，其權限不會超過你本身的權限。",
+    "ConfirmDeleteApiToken": "撤銷 API token「{{name}}」？此操作無法復原。",
+    "ApiTokenRevoked": "API token 已撤銷。",
+    "ApiTokenCreated": "API token 已建立",
+    "ApiTokenRevealOnce": "請立即複製此 token，之後將不再顯示。",
+    "ApiTokenStoreSafely": "請將此 token 視為密碼。任何持有者都能在其範圍內代表你操作。",
+    "ApiTokenServers": "伺服器",
+    "ApiTokenAllServers": "全部允許",
+    "ApiTokenNever": "永不",
+    "ApiTokenExpiresAt": "到期時間",
+    "ApiTokenLastUsed": "最後使用",
+    "ApiTokenServerIDs": "限制伺服器 ID（選填）",
+    "ApiTokenServerIDsPlaceholder": "以逗號分隔，例如 1,2,3",
+    "ApiTokenExpiresInDays": "有效天數（0 = 永不過期）",
+    "ApiTokenScopeRequired": "至少需要一個範圍。",
+    "ApiTokenServersInvalid": "伺服器 ID 必須為正整數。",
+    "ApiTokenExpiryInvalid": "天數必須介於 0 到 3650 之間。",
+    "NameRequired": "名稱為必填。",
+    "Revoke": "撤銷",
+    "Copy": "複製",
+    "Copied": "已複製到剪貼簿",
+    "Scopes": "範圍"
 }