The correct endpoint for WordPress is wp-json/civicrm/v3/rest. Its documented in the developer manual, see https://docs.civicrm.org/dev/en/latest/api/v3/wp-rest/#endpoints. When you just copy the URL that is suggested in the API explorer you are left in the dark.
You'll have an easier time modifying the permissions from within CiviCRM - Administer menu >> Users and Permissions >> Permissions (Access Control). When changing permissions from WP, you're usually dealing with machine names, not human-readable labels, so it can be hard to correlate error messages with the particular permission needed.
CSV Import and Form Processor IS a powerful combo! Check out the advimportformprocessor extension.
Note that this combines the "advimport" extension rather than the CSV API GUI extension with Form Processor. It's overall better, but some work on advimport's rough edges would improve the UX.
Also note that Form Processor is pretty slow, so imports ...
The function user_load is deprecated in D9.
Looks like we need a replacement stub function in the drupal module. For a quick hack, you could append this to /var/www/drupal/web/modules/contrib/civicrm/civicrm.module (or wherever it lives on your server).
A better ...