console: CNS-56 Add 'Create App Password' button to App Password page.

[jdonelson]

Motivation

Add a button that launches the "Create App Password" modal. The trigger was previously hidden in the "Create New" menu, generating feedback from users who weren't able to find it.

Closes CNS-56

Description

Button is hidden for users in Impersonation mode.

Verification

Added automated tests that confirm expected behavior and confirm that it is hidden for impersonation users.

[linear-code]

CNS-56

[def-]

QA LLM Review

1. MEDIUM -- New button's accessible name collides with the navbar "Create New" locator in the platform e2e test

console/e2e-tests/platform.spec.ts:104

The new header button is named "Create New App Password", and Playwright's getByRole matches name as a case-insensitive substring by default. On /access/app-passwords the locator getByRole("button", { name: "Create new" }) now resolves to both the navbar popover trigger ("Create New", console/src/layouts/NavBar/CreateObjectButton.tsx:82) and the new page button, so .click() raises a strict-mode violation and the surrounding toPass retries for 30s before failing the whole app-password creation flow.

Details

The spec navigates to /access, which redirects to /access/app-passwords (console/src/platform/AuthenticatedRoutes.tsx:137), and context.goto waits for [data-testid=page-layout], so the navbar and the new header button are both mounted before the click. CreateObjectButton is rendered unconditionally by NavBar (console/src/layouts/NavBar.tsx:237), so this is not a startup race that resolves itself: the retry loop just re-hits the ambiguity until the 30s budget runs out.

The spec already relies on this substring behaviour a few lines up, where the "App Password" popover entry is pinned with exact: true precisely because "App Passwords" would otherwise also match. The same fix applies here:

-      await page.getByRole("button", { name: "Create new" }).click();
+      await page.getByRole("button", { name: "Create New", exact: true }).click();

This spec runs on every PR in both console-e2e-test and console-e2e-test-prod, across the chromium and webkit projects.