Fix flaky E2E tests: strict mode violations, OAuth redirect, parallelism

- Set workers: 1 to eliminate parallelism race conditions
- Fix groups test: use .first() for "0 members" assertion
- Fix access-control helper: match by name instead of generic "Delete List"
- Fix forward-auth-oauth: target Dex button specifically, handle /login in Dex URL
- Add comprehensive API security E2E tests (316 tests)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/helpers/proxy-api.ts

@@ -257,6 +257,6 @@ export async function createAccessList(
 
   await page.getByRole('button', { name: /create access list/i }).click();
 
-  // Wait for the card to appear
-  await expect(page.getByRole('button', { name: /delete list/i })).toBeVisible({ timeout: 10_000 });
+  // Wait for the newly created card to appear (match by name to avoid strict-mode violations)
+  await expect(page.getByText(name).first()).toBeVisible({ timeout: 10_000 });
 }