test(authz): bearer-authed admin cannot edit/cover NULL-uploader mangas (0.87.19)

0.87.10 followup from the rereview. The fix lacked a test for the
specific axis it changed (admin authority via cookie only). New test
mints a bearer for a promoted admin and asserts PATCH/PUT-cover/DELETE-
cover all 403 on NULL-uploader rows. Mutation-confirmed.

Also: `MultipartBuilder::finalize` now `pub` for bearer-multipart use;
`admin_csrf_guard` rustdoc updated to describe the post-0.87.10
cookie-precedence rule.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/tests/common/mod.rs

@@ -615,7 +615,11 @@ impl MultipartBuilder {
         self.body.extend(b"\r\n");
     }
 
-    fn finalize(self) -> (String, Vec<u8>) {
+    /// Pub so a test can mint a multipart body for a bearer-auth Request
+    /// without going through the cookie helpers. Returns
+    /// `(boundary, body)` ready to attach as `Content-Type:
+    /// multipart/form-data; boundary={boundary}` and the request body.
+    pub fn finalize(self) -> (String, Vec<u8>) {
         let mut body = self.body;
         body.extend(format!("--{}--\r\n", self.boundary).as_bytes());
         (self.boundary, body)