Mastodon tests fail: need different way of obtaining API token

Since this was originally implemented, Mastodon has removed OAuth Resource Owner Password Credentials, which means our way of obtaining an API token is no longer viable. So all Mastodon-related tests that require the use of the API (i.e. all non-Webfinger tests) fail.

We need to find a different automatable avenue and implement that.

Start by locating the Mastodon-related tests that obtain an API token and separate them from the Webfinger tests. Reproduce the failure, then determine an automatable token path that works with current Mastodon behavior; done means all non-Webfinger Mastodon API tests pass without the removed password-grant flow.

Written by the indexing model from the issue text.