fix: 修复全部27个失败的e2e测试

根本原因: 所有测试硬编码了只在生产环境有效的admin token，
CI创建新数据库时token不同导致全部认证失败。

修复:
- CI: 设置已知ADMIN_TOKEN环境变量传给后端和Cypress
- cypress/support/e2e.js: 新增cy.getAdminToken()动态获取token
- 24个spec文件: 硬编码token改为cy.getAdminToken()
- UI选择器: 适配管理页面从tab移到UserMenu、编辑器DOM变化
- API: create_recipe→share_recipe、ingredients格式、权限变化
- 超时: 300s→420s适应32个spec

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/cypress/support/e2e.js

@@ -3,17 +3,94 @@
 // These are tracked separately; E2E tests focus on user-visible behavior.
 Cypress.on('uncaught:exception', () => false)
 
+// ── Admin token management ──────────────────────────────
+// In CI, the backend is started with ADMIN_TOKEN env var set to a known value.
+// Locally, the admin token may be the hardcoded dev value.
+// This helper tries multiple strategies to obtain a working admin token.
+
+let _cachedAdminToken = null
+
+/**
+ * Get a working admin token. Tries:
+ * 1. Cached token from previous call
+ * 2. CYPRESS_ADMIN_TOKEN env var (set via CI or cypress.env.json)
+ * 3. Hardcoded local dev token
+ * 4. Register a user and use its token (viewer-level fallback)
+ *
+ * Returns the token via cy.wrap() so it can be used in chains.
+ */
+Cypress.Commands.add('getAdminToken', () => {
+  if (_cachedAdminToken) {
+    return cy.wrap(_cachedAdminToken)
+  }
+
+  // Strategy 1: Try the CI token (passed via CYPRESS_ADMIN_TOKEN env or set in config)
+  const envToken = Cypress.env('ADMIN_TOKEN')
+  if (envToken) {
+    return cy.request({ url: '/api/me', headers: { Authorization: `Bearer ${envToken}` } }).then(res => {
+      if (res.body && res.body.role === 'admin') {
+        _cachedAdminToken = envToken
+        return cy.wrap(envToken)
+      }
+      // Token didn't work as admin, fall through
+      return _tryLocalToken()
+    })
+  }
+
+  return _tryLocalToken()
+})
+
+function _tryLocalToken() {
+  // Strategy 2: Try the hardcoded local dev token
+  const LOCAL_TOKEN = 'c86ae7afbe10fabe3c1d5e1a7fee74feaadfd5dc7be2ab62'
+  return cy.request({
+    url: '/api/me',
+    headers: { Authorization: `Bearer ${LOCAL_TOKEN}` },
+    failOnStatusCode: false
+  }).then(res => {
+    if (res.status === 200 && res.body && res.body.role === 'admin') {
+      _cachedAdminToken = LOCAL_TOKEN
+      return cy.wrap(LOCAL_TOKEN)
+    }
+    // Strategy 3: Register a test user — will be viewer but some tests just need any auth
+    // For admin-requiring tests, the CI must set ADMIN_TOKEN properly
+    return cy.request({
+      method: 'POST',
+      url: '/api/register',
+      body: { username: 'cypress_admin_fallback', password: 'cypresstest1234' },
+      failOnStatusCode: false
+    }).then(regRes => {
+      if (regRes.status === 201 || regRes.status === 200) {
+        _cachedAdminToken = regRes.body.token
+        return cy.wrap(regRes.body.token)
+      }
+      // Maybe already registered, try login
+      return cy.request({
+        method: 'POST',
+        url: '/api/login',
+        body: { username: 'cypress_admin_fallback', password: 'cypresstest1234' },
+        failOnStatusCode: false
+      }).then(loginRes => {
+        if (loginRes.status === 200) {
+          _cachedAdminToken = loginRes.body.token
+          return cy.wrap(loginRes.body.token)
+        }
+        // Last resort: return local token anyway
+        _cachedAdminToken = LOCAL_TOKEN
+        return cy.wrap(LOCAL_TOKEN)
+      })
+    })
+  })
+}
+
 // Custom commands for the oil calculator app
 
-// Login as admin via token injection
+// Login as admin via token injection — uses dynamic token
 Cypress.Commands.add('loginAsAdmin', () => {
-  cy.request('GET', '/api/users').then((res) => {
-    const admin = res.body.find(u => u.role === 'admin')
-    if (admin) {
-      cy.window().then(win => {
-        win.localStorage.setItem('oil_auth_token', admin.token)
-      })
-    }
+  cy.getAdminToken().then(token => {
+    cy.window().then(win => {
+      win.localStorage.setItem('oil_auth_token', token)
+    })
   })
 })
 
@@ -24,6 +101,13 @@ Cypress.Commands.add('loginWithToken', (token) => {
   })
 })
 
+// Get auth headers for API requests
+Cypress.Commands.add('adminHeaders', () => {
+  return cy.getAdminToken().then(token => {
+    return { Authorization: `Bearer ${token}` }
+  })
+})
+
 // Verify toast message appears
 Cypress.Commands.add('expectToast', (text) => {
   cy.get('.toast').should('contain', text)