- Set workers: 1 to eliminate parallelism race conditions - Fix groups test: use .first() for "0 members" assertion - Fix access-control helper: match by name instead of generic "Delete List" - Fix forward-auth-oauth: target Dex button specifically, handle /login in Dex URL - Add comprehensive API security E2E tests (316 tests) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>