test(e2e): W1 LIVE auth/login coverage (OAuth, logout-revocation, CLI, /auth/me, CORS) (#172)

Adds e2e/live-auth.spec.ts — the W1 (P0) real-backend auth suite from
docs/sessions/2026-06-04/USER-FLOW-INVENTORY-AND-TEST-MATRIX.md §W1. Closes
the matrix gap whose failure surface caused the 2026-05-29→30 prod-login
outage (a UI↔backend auth-integration regression).

Legs covered (E2E_LIVE=1-gated; whole file skips loudly in per-PR CI so the
gate never depends on a live backend):
  - A4/A6 GitHub OAuth: start → github.com authorize w/ single-use state;
    forged/never-issued state callback must fail closed (no session_token).
  - A7  /auth/exchange CORS contract (ACAC:true + ACAO:https://instanode.dev) —
    the AUTH-004 surface.
  - A8/A9 /auth/me: valid synthetic bearer → 200 + claimed email + tier='free';
    tampered + expired bearers → 401.
  - A10 logout revocation (the precise incident class): valid bearer 200 →
    POST /auth/logout → SAME bearer/jti on /auth/me → 401.
  - A12/A13 CLI device-flow: POST /auth/cli auth_url host == canonical
    instanode.dev (parsed hostname, not the api host); pre-approval poll →
    status, no api_token.
  - A1 magic-link START leg → 2xx {ok:true}; the FULL callback flow is
    test.skip with an explicit "blocked on Brevo sender validation (operator)"
    annotation, NOT a silent omission.

Mint path is Brevo-free (TEST-ACCOUNTS-AND-NR-SYNTHETICS-PLAN.md §1.1):
account legs provision→/claim a real user/team then mint an HS256 session JWT
with E2E_JWT_SECRET; they self-skip loudly when the secret is unset while the
contract-only legs still run. Every minted resource is cohort-branded +
ledgered-before-assert + reaped inline / afterAll / reap-cohort.ts (rule 24).
Mirrors live-anon-provision + auth-roundtrip patterns; named live-*.spec.ts so
playwright.live.config.ts picks it up and the default mocked config ignores it.
Wires optional E2E_JWT_SECRET into e2e-live.yml.

npm run gate: GREEN (tsc --noEmit + build + vitest 1115 passed / 3 skipped,
80 files; mocked suite unchanged). live config lists 11 tests, all skip
cleanly without E2E_LIVE.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mastermanas805

.github/workflows/e2e-live.yml

@@ -97,6 +97,13 @@ jobs:
         if: env.RUN_LIVE == '1'
         env:
           E2E_LIVE: '1'
+          # Optional: the api JWT_SECRET (staging). Enables the auth bearer legs
+          # in live-auth.spec.ts (/auth/me valid+expired, logout-revocation) that
+          # mint a session JWT locally — the Brevo-free account path
+          # (TEST-ACCOUNTS-AND-NR-SYNTHETICS-PLAN.md §1.1). Absent → those legs
+          # self-skip loudly; the contract-only legs (OAuth state-replay, CORS,
+          # CLI canonical host, magic-link start, tampered-token) still run.
+          E2E_JWT_SECRET: ${{ secrets.E2E_JWT_SECRET }}
         run: npm run test:e2e:live
 
       # Reaper ALWAYS runs (even on test failure/cancel) so a leaked resource