Fix flaky E2E tests: strict mode violations, OAuth redirect, parallelism

- Set workers: 1 to eliminate parallelism race conditions
- Fix groups test: use .first() for "0 members" assertion
- Fix access-control helper: match by name instead of generic "Delete List"
- Fix forward-auth-oauth: target Dex button specifically, handle /login in Dex URL
- Add comprehensive API security E2E tests (316 tests)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/e2e/functional/forward-auth-oauth.spec.ts

@@ -99,13 +99,19 @@ async function doOAuthLogin(page: Page, user: { email: string; password: string
     const p = await ctx.newPage();
     try {
       await p.goto(`${BASE_URL}/login`, { waitUntil: 'networkidle' });
-      console.log(`[doOAuthLogin] ${user.email} on: ${p.url()}`);
-      const oauthButton = p.getByRole('button', { name: /continue with|sign in with/i });
+      const oauthButton = p.getByRole('button', { name: /continue with dex|sign in with dex/i });
       await expect(oauthButton).toBeVisible({ timeout: 10_000 });
       await oauthButton.click();
-      // Wait for navigation to Dex
-      await p.waitForURL((url) => url.toString().includes('localhost:5556'), { timeout: 15_000 });
-      console.log(`[doOAuthLogin] ${user.email} after nav: ${p.url()}`);
+      // Better Auth does fetch then window.location.href — wait for Dex or error redirect
+      try {
+        await p.waitForURL((url) => {
+          const s = url.toString();
+          return s.includes('localhost:5556') || (!s.includes('localhost:3000/login'));
+        }, { timeout: 15_000 });
+      } catch {
+        if (attempt === 0) continue;
+        throw new Error(`OAuth redirect failed for ${user.email}: stuck on ${p.url()}`);
+      }
       await dexLogin(p, user.email, user.password);
       // Wait for redirect back to the app
       await p.waitForURL((url) => {

tests/e2e/groups.spec.ts

@@ -48,7 +48,7 @@ test.describe('Groups page', () => {
     // Group should appear in the list
     await expect(page.getByText('E2E Test Group')).toBeVisible({ timeout: 10_000 });
     await expect(page.getByText('Created by E2E test')).toBeVisible();
-    await expect(page.getByText('0 members')).toBeVisible();
+    await expect(page.getByText('0 members').first()).toBeVisible();
   });
 
   test('add member to group', async ({ page }) => {