test(e2e): fix Phase 1 spec timing (UX-1208)

Both fixes surfaced by running the suite locally:

- quota-error INTERNAL: query-client retries Code.Internal up to 4× with
  exponential backoff (~7s of delay), so the Alert appears after >10s.
  Bump assertion timeout to 30s.
- user-delete-error: sonner toasts do not survive page navigation. Move
  the toast assertion before the /security/users reload step.

Author: c-julin

frontend/tests/test-variant-console/acls/user-delete-error.spec.ts

@@ -41,13 +41,14 @@ test.describe('User deletion - error paths', () => {
     // Structural: must not navigate to list on failed delete.
     await expect(page).toHaveURL(`/security/users/${username}/details`);
 
-    // Reload list and confirm the user still appears — deletion truly didn't happen client-side.
-    await page.goto('/security/users', { waitUntil: 'domcontentloaded' });
-    await expect(page.getByRole('link', { name: username, exact: true })).toBeVisible({ timeout: 5000 });
-
     // Toast copy: formatToastErrorMessageGRPC composes "Failed to delete user: <rawMessage>".
+    // Asserted before the list-reload below — sonner toasts do not survive page navigation.
     await expect(page.getByText('Failed to delete user: user has dependent ACLs').first()).toBeVisible({
       timeout: 10_000,
     });
+
+    // Reload list and confirm the user still appears — deletion truly didn't happen client-side.
+    await page.goto('/security/users', { waitUntil: 'domcontentloaded' });
+    await expect(page.getByRole('link', { name: username, exact: true })).toBeVisible({ timeout: 5000 });
   });
 });

frontend/tests/test-variant-console/quotas/quota-error.spec.ts

@@ -34,7 +34,9 @@ test.describe('Quotas page - Connect error handling', () => {
     // Error UI: QuotasList renders a Chakra Alert (role="alert") containing the ConnectError
     // message when the failure is not permission-related. ConnectError stringifies as
     // "[<code>] <rawMessage>", so the mocked rawMessage is the deterministic substring to assert.
-    await expect(page.getByRole('alert')).toContainText('mocked backend failure', { timeout: 10_000 });
+    // Timeout accommodates the query-client's exponential-backoff retry policy for Code.Internal
+    // (4 attempts: 0, 1s, 2s, 4s — see src/query-client.ts).
+    await expect(page.getByRole('alert')).toContainText('mocked backend failure', { timeout: 30_000 });
   });
 
   test('ListQuotas PERMISSION_DENIED surfaces a permission message (not a raw gRPC code)', async ({ page }) => {