test(campaigns): promote cookie-safe request helper to shared conftest fixture

Moves the local _post cookie-clearing helper into a shared 'api' fixture
in conftest.py so later router tests in this plan (Tasks 10/11) don't
have to reinvent or forget the TestClient cookie-vs-Authorization-header
gotcha. Also adds a one-line comment at both require_any_role("manager")
call sites clarifying admin passthrough is automatic.

backend/tests/conftest.py

@@ -328,3 +328,25 @@ def manager_token(client, manager_user):
 def manager_headers(manager_token):
     """Return authorization headers for manager user."""
     return {"Authorization": f"Bearer {manager_token}"}
+
+
+@pytest.fixture(scope="function")
+def api(client):
+    """Issue an authenticated request while avoiding stale-cookie role bleed.
+
+    ``client``'s cookie jar persists across requests within a test, and
+    ``get_current_user`` prefers the ``aegis_token`` cookie over the
+    ``Authorization`` header. A test that uses more than one role's
+    ``*_headers`` fixture (e.g. submit as red_lead, then approve as
+    manager) would otherwise have its *first* request silently
+    authenticate as whichever role's fixture happens to log in last,
+    since pytest resolves all fixtures before the test body runs. Use
+    this instead of ``client.post``/``client.get`` directly whenever a
+    test mixes more than one role.
+
+    Usage: ``api("post", url, headers, json=payload)``.
+    """
+    def _request(method: str, url: str, headers: dict, **kwargs):
+        client.cookies.clear()
+        return getattr(client, method)(url, headers=headers, **kwargs)
+    return _request