_csrf is a hidden field; wait_for_selector defaults to state=visible and times out. Switch to the visible username input which proves the login form rendered. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>