test(e2e): fix SM13-SM15 rate-limit-window flake in state machine test

CI run 26351850079 on commit cdac344 surfaced 3 sub-test failures in
test_state_machine.cjs (after test_security_bypass.cjs PASSED):

  ❌ SM13 submitter cannot approve their own request → 403
     Expected self-approval block, got: {"error":"Rate limit exceeded.
     Please wait before retrying."}

  ❌ SM14 unrelated analyst cannot cancel another's request → 403
     Submit failed: This CSV is locked by a pending bulk row removal
     request from wladmin1...

  ❌ SM15 same CSV locked by pending request → 2nd submit rejected
     First submit failed: This CSV is locked by a pending bulk row
     removal request from wladmin1...

Root cause: by the time SM13 runs, wladmin1's per-user write rate-limit
budget (RATE_MAX_WRITES=30 / RATE_WINDOW=60s, see bin/wl_constants.py)
is exhausted from the 23-test test_security_bypass suite + SM06-SM12's
own writes. SM13's `process_approval` returns HTTP 429. The pre-test
`cleanupStaleRequests` call also fails silently for the same reason,
so SM13's leftover request stays in the queue → SM14/SM15 see the
"CSV is locked by a pending bulk row removal request" error at SUBMIT
time and fail.

Fix: pause 65 seconds before SM13 (one full RATE_WINDOW + 5s buffer)
to let wladmin1's rate-limit budget refresh. Adds 65s to the
test_state_machine.cjs runtime (~+65s total e2e-full.yml runtime).

This was the only failing test file in e2e-full run 26351850079; the
12 prior test files all passed. After this fix the suite should be
green end-to-end on cdac344.

Author: RelativisticJet

tests/e2e/test_state_machine.cjs

@@ -227,6 +227,17 @@ async function cleanupStaleRequests(page) {
 
     // ── Self-approval blocked ──
 
+    // Rate-limit budget refresh: SM01-SM12 plus the prior test_security_bypass
+    // suite consume wladmin1's RATE_MAX_WRITES=30/60s budget. Without a
+    // window-slide pause here, SM13's `process_approval` call returns
+    // 429 "Rate limit exceeded" instead of the expected 403 self-approval
+    // block, and SM14/SM15 inherit the leftover lock from SM13's
+    // unprocessed request. Pause 65s (one full rate-limit window + 5s
+    // buffer) so wladmin1 has a fresh budget for the final 3 sub-tests.
+    // See docs/V1_RC_RETRO.md (run 26351850079 evidence).
+    H.log("\u23f1\ufe0f", `  Waiting 65s for rate-limit window slide before SM13-SM15...`);
+    await new Promise(r => setTimeout(r, 65000));
+
     await cleanupStaleRequests(admin.page);
 
     await H.test("SM13 submitter cannot approve their own request \u2192 403", async () => {