feat(api-tokens): add PAT management UI, CSRF handling, and auth-loading fixes

Add an API tokens management route to create, list, and revoke PATs, showing
the plaintext token once on creation with scope and server-id selection.

Mirror the nz-csrf cookie into the X-CSRF-Token header on unsafe fetcher
methods (POST/PUT/PATCH/DELETE) for the server-side double-submit check, and
self-heal expired sessions via refresh-token without a recursive fetch loop.

Gate protected routes behind resolved auth state to avoid pre-auth SWR fetches,
and fix the login loading/race so stale probes cannot clobber the session.

Add i18n keys for the new screens across all locales.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

src/main.tsx

@@ -30,6 +30,7 @@ import SettingsPage from "./routes/settings"
 import TransferPage from "./routes/transfer"
 import UserPage from "./routes/user"
 import WAFPage from "./routes/waf"
+import ApiTokensPage from "./routes/api-tokens"
 
 const router = createBrowserRouter([
     {
@@ -147,6 +148,10 @@ const router = createBrowserRouter([
                 path: "/dashboard/settings/online-user",
                 element: <OnlineUserPage />,
             },
+            {
+                path: "/dashboard/settings/api-tokens",
+                element: <ApiTokensPage />,
+            },
             {
                 path: "/dashboard/transfer",
                 element: <TransferPage />,