Summary
- Default mutating E2E runs to off; require explicit opt-in, a numeric loopback origin, and an existing disposable SQLite file under a dedicated temp directory.
- Keep requests on the configured origin and do not follow probe redirects.
- Replace default-database wildcard cleanup with exact, current-run account cleanup against that explicit disposable file.
- Document safe setup and the separate, still-open migration of legacy auth assertions.
Verification
- Six isolated safety regressions passed, including symlink rejection, cross-origin rejection, and preservation of prior-run accounts.
- Twenty-six legacy E2E cases explicitly skipped; these are not authenticated QA passes.
- Changed TypeScript files passed Pickier; project typecheck passed.
Scope
Four files in one commit. Test infrastructure only; no production settings, secrets, or application behavior changed. Authenticated live QA is still waiting for user sign-in. Do not merge without user approval.