✨ feat: enhance admin API helpers with CRUD operations for collections and seed data management

- Added functions for creating, updating, deleting, and listing collection entries in admin API.
- Introduced seed data management for consistent test content across tests.
- Updated global setup and teardown processes to ensure seeded content is created and cleaned up.
- Refactored existing tests to utilize seeded content for improved reliability and maintainability.

AGENTS.md

@@ -26,6 +26,7 @@ Derive these values from the real repo path `gitbase.de/ORG/REPO`:
 - `api/hooks/config-client.js`: replace `https://__PROJECT__.code.testversion.online` with the real origin URL.
 - `package.json`: adapt starter metadata like `name` and `repository` when creating the real project repo.
 - Docker and local URLs derive from `.env`, so `PROJECT_NAME` and `TIBI_NAMESPACE` must be correct before `make docker-up`.
+- Playwright seed/API tests read `CODING_URL` from `.env` first. Use the configured host from `.env` whenever it serves both `/` and `/api/...`, even in starter-style local bootstrap setups.
 - Recommended check: search for remaining starter placeholders with `rg '__[A-Z0-9_]+__' .`.
 
 ## Setup commands
@@ -57,6 +58,7 @@ Derive these values from the real repo path `gitbase.de/ORG/REPO`:
 - E2E tests: `yarn test:e2e`
 - API tests: `yarn test:api`
 - Visual regression: `yarn test:visual`
+- Before running Playwright, ensure the `CODING_URL` from `.env` actually serves both `/` and `/api/...` for this repo.
 - After code changes, run only affected spec files: `npx playwright test tests/e2e/filename.spec.ts`.
 - Write unit tests for new functionality and ensure existing tests pass.
 
@@ -74,6 +76,8 @@ Derive these values from the real repo path `gitbase.de/ORG/REPO`:
 
 - API access to collections uses the reverse proxy: `CODING_URL/api/<collection>` (e.g. `CODING_URL/api/content`).
 - Auth via `Token` header with `ADMIN_TOKEN` from `api/config.yml.env` when a configured token with the required permissions is needed.
+- Collection permissions for `user:` apply to JWT-authenticated users (`X-Auth-Token`), not to the static `Token:` header.
+- If a collection should allow writes via `ADMIN_TOKEN`, define an explicit permission block like `"token:${ADMIN_TOKEN}":` with the required methods.
 
 ## Required secrets and credentials