Fix flaky E2E tests: strict mode violations, OAuth redirect, parallelism

- Set workers: 1 to eliminate parallelism race conditions
- Fix groups test: use .first() for "0 members" assertion
- Fix access-control helper: match by name instead of generic "Delete List"
- Fix forward-auth-oauth: target Dex button specifically, handle /login in Dex URL
- Add comprehensive API security E2E tests (316 tests)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/playwright.config.ts

@@ -6,7 +6,7 @@ export default defineConfig({
   globalSetup: './global-setup.ts',
   globalTeardown: './global-teardown.ts',
   fullyParallel: false,
-  workers: 2,
+  workers: 1,
   retries: 0,
   timeout: 60_000, // functional tests need time for Caddy reloads
   reporter: 'list',