test(production): harden authenticated browser coverage

[StringKe]

What changed

• cover all 36 Console management routes with role-correct redirect assertions
• validate Email OTP consumption and replay rejection against production
• cover Password, MFA self-service, backup codes, MFA challenge, Passkey, Core SDK and React SDK flows
• launch headed Chrome in the macOS background and close it through CDP so production Turnstile E2E does not steal focus
• make navigation, locale, account shell and Cloudflare D1 control-plane checks deterministic
• align the OTP contract documentation with consumed-at compare-and-swap semantics

Why

The earlier production browser smoke covered only part of Console and assumed English, immediate SPA navigation, a working pnpm esbuild shim and uninterrupted Cloudflare control-plane access. Those assumptions caused false failures and left authenticated management surfaces unverified.

Validation

• production browser E2E: PASS, including Email OTP, 36 Console routes, Account, Password, MFA, 10 backup codes, Passkey, Core SDK and React SDK

• production residue sweep: PASS, 27 tables with 0 smoke rows

• pnpm check: PASS

• pnpm test: PASS, including 2668 Worker tests and 219 SPA tests

• dependency audit: PASS, no known high-severity production vulnerabilities

• repository secret scan: PASS

• git diff --check: PASS

• No secrets, .env files, real tokens, private keys or real tenant identifiers in the diff

• Every commit includes DCO sign-off