Add cookie-based authentication testing to e2e tests for human user flow coverage

## Problem

The current `api/test-management-api-e2e.sh` script only tests M2M (machine-to-machine) authentication using JWT Bearer tokens. This leaves a gap in test coverage for human user authentication flows that use session cookies.

During recent deployment testing, we discovered that the admin user created by `init-keycloak.sh` was not assigned to the `registry-admins` group, which caused "Permission Required" errors when attempting to register servers via the browser UI. This issue was not caught by the e2e tests because they only exercise the JWT token path.

## Current Behavior

- E2E tests accept `--token-file` parameter with JWT tokens
- Tests use `Authorization: Bearer ` header for all API calls
- Human user login flow (OAuth2 redirect → session cookie) is not tested
- Group membership issues for browser-based users go undetected

## Proposed Enhancement

Add a `--cookie-auth` or `--human-user` mode to the e2e test script that:

1. Performs OAuth2 login flow to obtain session cookies
2. Uses cookies instead of Bearer tokens for API requests
3. Tests the same CRUD operations (groups, users, servers, agents)
4. Validates that human users have correct permissions

This would enable testing both authentication paths:
```bash
# M2M testing (current)
./test-management-api-e2e.sh --token-file api/.token

# Human user testing (proposed)
./test-management-api-e2e.sh --cookie-auth --username admin --password --keycloak-url
```

## Benefits

- Catch permission/group assignment issues before they affect end users
- Validate that `init-keycloak.sh` correctly provisions admin users
- Test the complete authentication flow including OAuth2 redirects
- Ensure parity between M2M and human user access patterns

## Related

- PR #365 fixed the `registry-admins` group assignment issue that would have been caught by this test