test(e2e): functional deploy-failure debug-path live UI spec + factory withFailedDeploy (#195)

The CEO's core ask: CI must FUNCTIONALLY prove the debug path works — "deploy an
app and get its logs; fail a deployment and get its logs/events" — not just that
llms.txt redirects. Adds e2e/live-ui-failure-diag.spec.ts (real backend, minted
cohort, reaped) with three legs:

  - Happy deploy → logs (schedule lane): mint pro → create deploy (202) → the
    build-logs endpoint authorizes the owner and returns a recognized state
    (200 streaming / 409 not_ready-still-building / 404 GC'd, NOT 401/5xx) AND
    the LiveBuild SSE panel reaches a rendered stream state in the UI.
  - Failed deploy → /events (API, @pr-smoke): mint with_failed_deploy →
    GET /api/v1/deployments/:id = status=failed + non-empty error_message;
    GET /api/v1/deployments/:id/events = autopsy event with reason (OOMKilled) +
    non-empty last_lines + hint; + auth-negative (401) + cross-team (404). This
    is the agent auto-debug surface, asserted end to end.
  - Failed deploy → UI (FailureAutopsyPanel, @pr-smoke): load
    /app/deployments/:id in the browser (minted session) → the panel renders the
    reason heading + hint + last_lines (log toggle) against a real backend.

Extends e2e/factory.ts with mintUserWithFailedDeploy() (with_failed_deploy →
failed_deploy_id, api 021bb7e). The two failed-deploy legs are @pr-smoke (fast:
seeded reads + panel render, no real Kaniko build) so the debug surface can't
silently regress on a web PR; the happy real-deploy leg stays on the schedule.
Cohort-tagged + reaped (rule 24); gated on the e2e token (skip-clean).

Verified live against prod api 021bb7e: all 4 legs pass, reap clean
(attempted=8 deleted=5 alreadyGone=3 failed=0, ledger cleared).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: mastermanas805

e2e/factory.ts

@@ -72,6 +72,14 @@ export interface MintedUser {
   sessionJWT: string
   /** Pre-seeded resource tokens (empty unless mintUserWithResources was used). */
   seededTokens: string[]
+  /**
+   * The app_id of the seeded FAILED deployment (status=failed + a
+   * failure_autopsy event with reason/last_lines/hint), present only when minted
+   * via mintUserWithFailedDeploy(). Empty string otherwise. The failure-diag
+   * journey navigates to /app/deployments/<failedDeployID> and reads
+   * GET /api/v1/deployments/<id>/events with this id.
+   */
+  failedDeployID: string
 }
 
 interface MintResponseBody {
@@ -82,13 +90,23 @@ interface MintResponseBody {
   session_jwt: string
   seeded_tokens?: string[]
   seeded_count?: number
+  failed_deploy_id?: string
 }
 
 // ── Mint ─────────────────────────────────────────────────────────────────────
 
 interface MintOpts {
   tier?: MintableTier
   withResources?: boolean
+  /**
+   * Pre-seed ONE failed deployment + its failure_autopsy event (OOMKilled, exit
+   * 137, JS-heap last_lines, a memory hint) on the minted team. Surfaces the
+   * deployment's app_id as failed_deploy_id on the response. Pure DB rows on the
+   * api side (no k8s) — synchronous + sub-ms. Used by the failure-diagnosis
+   * journey to render the FailureAutopsyPanel + read /events against a real
+   * backend. api: internal_e2e_account.go with_failed_deploy (#70, 021bb7e).
+   */
+  withFailedDeploy?: boolean
 }
 
 /**
@@ -111,7 +129,11 @@ export async function mintUser(
   const resp = await request.fetch(`${base}/internal/e2e/account`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', [E2E_ACCOUNT_TOKEN_HEADER]: accountToken() },
-    data: JSON.stringify({ tier, with_resources: !!opts.withResources }),
+    data: JSON.stringify({
+      tier,
+      with_resources: !!opts.withResources,
+      with_failed_deploy: !!opts.withFailedDeploy,
+    }),
     failOnStatusCode: false,
   })
   // Inert-by-default 404: the token is wrong or the endpoint isn't armed on
@@ -141,6 +163,7 @@ export async function mintUser(
     tier: body.tier,
     sessionJWT: body.session_jwt,
     seededTokens: body.seeded_tokens ?? [],
+    failedDeployID: body.failed_deploy_id ?? '',
   }
 }
 
@@ -152,6 +175,21 @@ export function mintUserWithResources(
   return mintUser(request, { ...opts, withResources: true })
 }
 
+/**
+ * Mint an account pre-seeded with ONE failed deployment + its failure_autopsy
+ * event (default tier pro — deployments_apps headroom). The returned
+ * MintedUser.failedDeployID is the seeded deployment's app_id; the
+ * failure-diagnosis journey navigates to /app/deployments/<failedDeployID> and
+ * reads GET /api/v1/deployments/<id>/events with it. Returns null when the
+ * factory is unarmed (caller SKIPs). See mintUser + the withFailedDeploy opt.
+ */
+export function mintUserWithFailedDeploy(
+  request: APIRequestContext,
+  opts: Omit<MintOpts, 'withFailedDeploy'> = {},
+): Promise<MintedUser | null> {
+  return mintUser(request, { tier: 'pro', ...opts, withFailedDeploy: true })
+}
+
 /**
  * Mint at the deployments_apps cap: a hobby account (deployments_apps=1). The
  * delete-when-exhausted→replace journey (#4) fills the single slot, asserts the