test(e2e): 18 real Playwright tests close gate-19 137 -> 112 (#486)

gate-19 e2e-coverage: 137 -> 112 with 18 real Playwright tests, 0 exclusions.

Measured with the canonical gate package at the development -> beta scope (the
one the open release PR uses), reading its printed summary line rather than the
exit status. Negative control: 112 -> 116 (+4, exactly the removed file's
anchors) -> 112.

Every test proven able to fail by a planted true positive. Two traps hit while
proving that, both of which first read as "my tests are blind":
opcache.revalidate_freq=60 makes a PHP plant invisible for up to a minute, and
the GEMMA dimension list exists in three independent copies.

Found and filed, not worked around: every write through adminApi.js failed CSRF
(seven UI actions dead — fixed here); the suite wizard's success result is never
rendered; two gemma-faceted-search requirements are unimplemented; sixteen
file-level @e2e tags claim coverage a file says it does not provide; 23
whole-spec exclude markers retire 30% of all scenarios.

Also deletes src/views/gemmaviews/GemmaViewIndex.vue, proven unreachable: the
bundle built with the file present is byte-identical to the bundle built
without it.

Refs #481 #482 #483 #484 #485

Author: rubenvdlinde

src/utils/adminApi.js

@@ -16,6 +16,8 @@
  * SPDX-License-Identifier: EUPL-1.2
  */
 
+import { getRequestToken } from '@nextcloud/auth'
+
 const API_BASE = '/index.php/apps/softwarecatalog/api'
 
 /**
@@ -50,11 +52,40 @@ export async function apiRequest(path, options = {}, fetchImpl = undefined) {
 		throw new Error('No fetch implementation available')
 	}
 
+	// ⚠️ `requesttoken` is NOT optional on a state-changing request.
+	//
+	// Nextcloud's CSRF middleware rejects any cookie-authenticated request
+	// whose method is not GET/HEAD unless the controller declares
+	// `#[NoCSRFRequired]` OR the request carries the session's request token.
+	// `X-Requested-With: XMLHttpRequest` does NOT satisfy it — that header was
+	// dropped as a CSRF signal long ago.
+	//
+	// Without this header EVERY write that goes through this helper failed
+	// with a rendered "CSRF check failed" alert and no server-side effect:
+	//   SubmitReviewModal      POST reviews
+	//   ModerationQueue        POST moderation/{uuid}/approve|reject
+	//   FederationSettings     POST/DELETE federation/peers, POST federation/pull
+	//   EolSyncSettings        POST eol-sync/config, POST eol-sync/trigger
+	// None of those controllers is `#[NoCSRFRequired]`, so none of them was
+	// reachable from the UI. Measured, not inferred: a Playwright run driving
+	// the real "Write a review" modal captured the alert text `CSRF check
+	// failed` in the dialog, and the same flow passes once this header is sent.
+	//
+	// Reads are unaffected (GET is exempt), which is why the settings sections
+	// rendered correctly and only their WRITE actions were dead — a failure
+	// mode that looks like "the button does nothing".
+	//
+	// `getRequestToken()` reads the token @nextcloud/auth keeps in sync with
+	// the `data-requesttoken` head meta, so it stays correct across NC's
+	// token rotation. This is the same source `@nextcloud/axios` uses; the
+	// sibling store `src/store/modules/facets.js` already goes through axios
+	// and was never affected.
 	const init = {
 		method: options.method || 'GET',
 		headers: {
 			'Content-Type': 'application/json',
 			'X-Requested-With': 'XMLHttpRequest',
+			requesttoken: getRequestToken() ?? '',
 		},
 	}
 	if (options.body !== undefined && options.body !== null) {