Make the admin's buttons work in a browser

Every mutating form now carries the CSRF token as a hidden field, and the
upload route accepts it as a multipart field as well as a header. Driving the
real UI in Firefox found what the header-only tests could not: Create Draft,
Save, Publish, Delete and the up/down buttons all posted without a token and
were rejected. Adds npm run check-site, which verifies a running Site from the
outside and exits non-zero so it can gate a cutover.

README.md

@@ -22,6 +22,13 @@ which needs a human present.
 then the playbook in `ansible-playbooks/menu-admin/` — its readme covers the
 parallel run, the `site.env` step that gives the admin a password, and cutover.
 
+After deploying, check the running site from the outside (read-only, exits
+non-zero on failure, so it can gate a cutover):
+
+```sh
+npm run check-site -- https://menu-new.hopsngrains.com
+```
+
 ## Layout
 
 ```