review fixes: seeded-auth hard gate, ci.yml build serialization, assets 404

- M1: E2E_REQUIRE_SEEDED_AUTH=1 in the CI e2e step makes login failures hard
  failures (loginAs throws, guards disabled, globalSetup refuses a pre-populated
  DB); auth.spec redirect test asserts outright under the flag; non-admin
  /admin test is now a real authorization assertion
- M2: ci.yml build step depends_on test — never two concurrent turbo builds
  on the shared workspace
- M3: unknown /assets/* paths 404 from the SPA catch-all instead of serving
  index.html with an immutable cache header; spec arm added
- minors: e2e step gets when: *image_build_when, health poll uses
  GATEWAY_PORT + AbortSignal.timeout, BETTER_AUTH_SECRET generated per run
  (no literal in tree), failure echoes artifact path, dev-guide documents the
  gate, stale verify-release comment fixed

.woodpecker/ci.yml

@@ -264,7 +264,12 @@ steps:
       - *enable_pnpm
       - pnpm build
     depends_on:
-      - typecheck
+      # after test, not typecheck: turbo gives `test` a ^build dependency, so
+      # running this step concurrently with test would put two independent
+      # turbo builds on the same shared-workspace dist/ and turbo cache with
+      # no cross-process locking — the same serialization invariant
+      # publish.yml documents for #1411.
+      - test
 
 services:
   ci-postgres:

.woodpecker/publish.yml

@@ -416,7 +416,8 @@ steps:
   #
   # Image pinned to the @playwright/test version in pnpm-lock.yaml so the
   # image's bundled browsers match the workspace driver exactly (bump the two
-  # together). The step installs nothing: it reuses the workspace node_modules
+  # together). The step installs no workspace packages (corepack does fetch
+  # the pinned pnpm itself): it reuses the workspace node_modules
   # from `install` and the dist outputs from `build` — the gateway's runtime
   # dependency path is pure JS/WASM (PGlite is WASM, postgres-js is pure JS),
   # so the alpine-installed modules run unchanged under this glibc image.
@@ -426,14 +427,20 @@ steps:
   e2e:
     image: mcr.microsoft.com/playwright:v1.58.2-noble
     environment:
-      # Test-only value for this step's throwaway embedded database; the
-      # gateway refuses to boot without one. Not a credential.
-      BETTER_AUTH_SECRET: ci-e2e-throwaway-value
       GATEWAY_PORT: '14242'
       PLAYWRIGHT_BASE_URL: http://localhost:14242
+      # The database is seeded by Playwright's globalSetup in this step, so
+      # login failures are real failures: without this flag the suite's
+      # skip-when-login-fails guards (a live-environment affordance) could
+      # skip every authenticated spec and go green while proving nothing.
+      E2E_REQUIRE_SEEDED_AUTH: '1'
     commands:
       - corepack enable
       - |
+        # Throwaway signing secret for this step's ephemeral embedded database
+        # (the gateway refuses to boot without one). Generated per run so no
+        # usable literal lives in the tree.
+        export BETTER_AUTH_SECRET="$(head -c 32 /dev/urandom | base64)"
         export WEB_DIST_DIR="$(pwd)/apps/web/dist"
         if [ ! -f "$WEB_DIST_DIR/index.html" ]; then
           echo "[e2e] FATAL: $WEB_DIST_DIR/index.html missing — did the build step run?" >&2
@@ -449,7 +456,7 @@ steps:
         GATEWAY_PID=$!
         ready=0
         for i in $(seq 1 90); do
-          if node -e "fetch('http://localhost:14242/health').then((r) => process.exit(r.ok ? 0 : 1), () => process.exit(1))"; then
+          if node -e "fetch('http://localhost:' + process.env.GATEWAY_PORT + '/health', { signal: AbortSignal.timeout(2000) }).then((r) => process.exit(r.ok ? 0 : 1), () => process.exit(1))"; then
             ready=1
             break
           fi
@@ -475,8 +482,14 @@ steps:
         if [ "$E2E_EXIT" -ne 0 ]; then
           echo "[e2e] FATAL: Playwright suite failed (exit $E2E_EXIT); gateway log follows" >&2
           tail -100 /tmp/gateway.log >&2
+          echo "[e2e] browser-side traces/screenshots are under apps/web/test-results/ in the step workspace (not persisted past the pod)" >&2
         fi
         exit "$E2E_EXIT"
+    # Same filter as the image builds it gates: a merge that publishes no
+    # image (docs-only on main) pays no browser suite, and a skipped e2e does
+    # not block anything (skipped-dependency semantics, same as
+    # publish-next-npm on tag events).
+    when: *image_build_when
     depends_on:
       - build
       - verify