⚡ e2e mock: replace fixed sleeps with condition polling

The `sleep 4` / `sleep 3` after a decision change were magic numbers tied to
updateIntervalSeconds / defaultDecisionSeconds. Replace them with waits on the
actual condition:

- After a ban/unban, poll with wait_for_status until the expected code shows up
  (stream propagation / live-mode cache TTL).
- Captcha keeps status 200 before and after, so gate on the body marker via a
  new wait_for_body_contains helper.
- Control assertions that must NOT change stay immediate (assert_status).

Self-documenting, faster on the happy path (returns on the first poll that
sees the change), and more robust under slow CI. No fixed sleeps remain.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/e2e/mock/lib/common.sh

@@ -90,6 +90,25 @@ wait_for_status() {
   return 1
 }
 
+# Poll a URL until its body contains a substring, or fail. Used when the status
+# code alone can't tell the states apart (e.g. captcha page vs backend, both 200).
+# Usage: wait_for_body_contains URL NEEDLE [TIMEOUT_SECONDS] [curl args...]
+wait_for_body_contains() {
+  local url="$1" needle="$2" timeout="${3:-30}"
+  shift 3 || true
+  local elapsed=0 body=""
+  while (( elapsed < timeout )); do
+    body=$(curl -s "$@" "$url" || true)
+    if grep -q "$needle" <<<"$body"; then
+      return 0
+    fi
+    sleep 1
+    elapsed=$((elapsed + 1))
+  done
+  echo "wait_for_body_contains: $url did not contain \"$needle\" within ${timeout}s" >&2
+  return 1
+}
+
 # Assert a single curl returns the expected status code.
 # Usage: assert_status URL CODE [curl args...]
 assert_status() {