Fix flaky E2E tests: strict mode violations, OAuth redirect, parallelism

- Set workers: 1 to eliminate parallelism race conditions
- Fix groups test: use .first() for "0 members" assertion
- Fix access-control helper: match by name instead of generic "Delete List"
- Fix forward-auth-oauth: target Dex button specifically, handle /login in Dex URL
- Add comprehensive API security E2E tests (316 tests)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/e2e/functional/forward-auth-oauth.spec.ts

@@ -99,13 +99,19 @@ async function doOAuthLogin(page: Page, user: { email: string; password: string
     const p = await ctx.newPage();
     try {
       await p.goto(`${BASE_URL}/login`, { waitUntil: 'networkidle' });
-      console.log(`[doOAuthLogin] ${user.email} on: ${p.url()}`);
-      const oauthButton = p.getByRole('button', { name: /continue with|sign in with/i });
+      const oauthButton = p.getByRole('button', { name: /continue with dex|sign in with dex/i });
       await expect(oauthButton).toBeVisible({ timeout: 10_000 });
       await oauthButton.click();
-      // Wait for navigation to Dex
-      await p.waitForURL((url) => url.toString().includes('localhost:5556'), { timeout: 15_000 });
-      console.log(`[doOAuthLogin] ${user.email} after nav: ${p.url()}`);
+      // Better Auth does fetch then window.location.href — wait for Dex or error redirect
+      try {
+        await p.waitForURL((url) => {
+          const s = url.toString();
+          return s.includes('localhost:5556') || (!s.includes('localhost:3000/login'));
+        }, { timeout: 15_000 });
+      } catch {
+        if (attempt === 0) continue;
+        throw new Error(`OAuth redirect failed for ${user.email}: stuck on ${p.url()}`);
+      }
       await dexLogin(p, user.email, user.password);
       // Wait for redirect back to the app
       await p.waitForURL((url) => {

tests/e2e/groups.spec.ts

@@ -48,7 +48,7 @@ test.describe('Groups page', () => {
     // Group should appear in the list
     await expect(page.getByText('E2E Test Group')).toBeVisible({ timeout: 10_000 });
     await expect(page.getByText('Created by E2E test')).toBeVisible();
-    await expect(page.getByText('0 members')).toBeVisible();
+    await expect(page.getByText('0 members').first()).toBeVisible();
   });
 
   test('add member to group', async ({ page }) => {

tests/helpers/proxy-api.ts

@@ -257,6 +257,6 @@ export async function createAccessList(
 
   await page.getByRole('button', { name: /create access list/i }).click();
 
-  // Wait for the card to appear
-  await expect(page.getByRole('button', { name: /delete list/i })).toBeVisible({ timeout: 10_000 });
+  // Wait for the newly created card to appear (match by name to avoid strict-mode violations)
+  await expect(page.getByText(name).first()).toBeVisible({ timeout: 10_000 });
 }

tests/playwright.config.ts

@@ -6,7 +6,7 @@ export default defineConfig({
   globalSetup: './global-setup.ts',
   globalTeardown: './global-teardown.ts',
   fullyParallel: false,
-  workers: 2,
+  workers: 1,
   retries: 0,
   timeout: 60_000, // functional tests need time for Caddy reloads
   reporter: 'list',