test(campaigns): promote cookie-safe request helper to shared conftest fixture

Moves the local _post cookie-clearing helper into a shared 'api' fixture
in conftest.py so later router tests in this plan (Tasks 10/11) don't
have to reinvent or forget the TestClient cookie-vs-Authorization-header
gotcha. Also adds a one-line comment at both require_any_role("manager")
call sites clarifying admin passthrough is automatic.

backend/app/routers/campaigns.py

@@ -446,6 +446,7 @@ def approve_campaign_endpoint(
     campaign_id: str,
     payload: ApprovePayload,
     db: Session = Depends(get_db),
+    # admin passes automatically via require_any_role's built-in bypass — do not add "admin" here
     current_user: User = Depends(require_any_role("manager")),
 ) -> dict:
     """Manager approves a pending campaign, fixing its start date and activating it."""
@@ -477,6 +478,7 @@ def reject_campaign_endpoint(
     campaign_id: str,
     payload: RejectPayload,
     db: Session = Depends(get_db),
+    # admin passes automatically via require_any_role's built-in bypass — do not add "admin" here
     current_user: User = Depends(require_any_role("manager")),
 ) -> dict:
     """Manager rejects a pending campaign, returning it to draft with a reason."""