More integration test for report intake + moderation flow.

[isoos]

• New moderation and report processing flow #7535
• Needed to update TestUser with a separation of browserApi (using session cookies) and serverApi (using JWT tokens).
• Created a fake server endpoint to generate a token. An alternative would be to move a lot of code to pkg/_pub_shared, but I'd rather keep them together in app/, as it is more in focus.
• The test flow revealed that we still need another admin action to close a moderation case, implementing it in a follow-up PR.