test(e2e): isolate mutating runs and account cleanup

tests/e2e/README.mdadded+29-0

Changes to tests/e2e/README.md

		@@ -0,0 +1,29 @@
	1	+# Local E2E safety
	2	+
	3	+These mutating HTTP suites are disabled by default. A reachable development server
	4	+does not opt a normal unit-test run into account creation or database cleanup.
	5	+
	6	+An intentional run requires all three variables:
	7	+
	8	+- `E2E_RUN=1`
	9	+- `E2E_BASE_URL`: an HTTP numeric-loopback origin with an explicit port, such as
	10	+ `http://127.0.0.1:3100`. Remote hosts, redirects and URL credentials are not allowed.
	11	+- `E2E_SQLITE_PATH`: an absolute path to an existing `database.sqlite` inside a
	12	+ freshly created `loghq-e2e-*` directory directly under the system temp directory.
	13	+
	14	+Start a separate local application instance using that same disposable database.
	15	+Do not point the test instance at real data. Disable outbound mail, notifications,
	16	+webhooks and paid integrations in that instance before running these suites.
	17	+The URL guard cannot prove which database or integrations a local server uses;
	18	+the operator must configure the isolated server correctly.
	19	+
	20	+Cleanup opens only the explicitly named disposable SQLite file and only removes
	21	+accounts whose exact email addresses were generated in this process. It never
	22	+uses the application's default database connection or a wildcard email match.
	23	+
	24	+## Known coverage gap
	25	+
	26	+The auth and routing suites still contain expectations for the previous page-action
	27	+login and readable `loghq_token` cookie. They need migration to the current JSON
	28	+auth endpoints and HttpOnly `auth-token` contract before they can serve as a current
	29	+auth release gate. This safety guard does not claim those legacy expectations pass.