test(stalker): await the first authenticated content request

The re-auth test kept failing on CI (3/3 attempts) with an undefined
token while passing locally. My earlier diagnosis — a sibling spec's
global /reset — was wrong: the failure survived the scoped-reset fix.

Real cause is a race in the test itself. `addFullStalkerPortal` only
awaits the route change, so on a slower runner the first authenticated
content request has not been recorded yet when the token is read; the
sibling test that passes happens to await `.category-item` first. Poll
for a content request carrying a token before capturing it.

The scoped-reset work stands on its own merits (cross-file resets were
a real hazard), it just was not what broke this test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/web-e2e/src/stalker.e2e.ts

@@ -962,6 +962,21 @@ test.describe('@stalker full portal authentication', () => {
 
         await addFullStalkerPortal(page, { mac: AUTH_REAUTH_MAC });
 
+        // `addFullStalkerPortal` only awaits the route change, and on a slow
+        // runner the first authenticated content request has not necessarily
+        // gone out by then — poll for it instead of reading the log once.
+        await expect
+            .poll(
+                () =>
+                    requests.some(
+                        (entry) =>
+                            CONTENT_ACTIONS.includes(entry.action) &&
+                            entry.token
+                    ),
+                { timeout: 30_000 }
+            )
+            .toBe(true);
+
         // The token the initial import authenticated with — recovery must end
         // up on a DIFFERENT one, or nothing was actually re-negotiated.
         const tokenBeforeInvalidation = requests.find(