review fixes: seeded-auth hard gate, ci.yml build serialization, assets 404

- M1: E2E_REQUIRE_SEEDED_AUTH=1 in the CI e2e step makes login failures hard
  failures (loginAs throws, guards disabled, globalSetup refuses a pre-populated
  DB); auth.spec redirect test asserts outright under the flag; non-admin
  /admin test is now a real authorization assertion
- M2: ci.yml build step depends_on test — never two concurrent turbo builds
  on the shared workspace
- M3: unknown /assets/* paths 404 from the SPA catch-all instead of serving
  index.html with an immutable cache header; spec arm added
- minors: e2e step gets when: *image_build_when, health poll uses
  GATEWAY_PORT + AbortSignal.timeout, BETTER_AUTH_SECRET generated per run
  (no literal in tree), failure echoes artifact path, dev-guide documents the
  gate, stale verify-release comment fixed

apps/web/e2e/global-setup.ts

@@ -1,5 +1,5 @@
 import type { FullConfig } from '@playwright/test';
-import { ADMIN_USER, TEST_USER } from './helpers/auth.js';
+import { ADMIN_USER, REQUIRE_SEEDED_AUTH, TEST_USER } from './helpers/auth.js';
 
 /**
  * Seed the E2E users through the gateway's real APIs (#1445, P6).
@@ -10,7 +10,9 @@ import { ADMIN_USER, TEST_USER } from './helpers/auth.js';
  *
  * Against an environment that already has users (needsSetup=false), seeding is
  * skipped entirely: the specs keep their own skip-when-login-fails guards, so
- * a live environment stays usable as a test target without mutation.
+ * a live environment stays usable as a test target without mutation. Under
+ * E2E_REQUIRE_SEEDED_AUTH=1 (CI) that state is instead a hard failure and the
+ * guards are disabled — see helpers/auth.ts.
  *
  * On a fresh database, any seeding failure throws and fails the whole run: an
  * E2E gate whose authenticated suites silently skip would pass while proving
@@ -25,6 +27,14 @@ export default async function globalSetup(config: FullConfig): Promise<void> {
   }
   const status = (await statusRes.json()) as { needsSetup: boolean };
   if (!status.needsSetup) {
+    if (REQUIRE_SEEDED_AUTH) {
+      // CI boots the gateway on a fresh HOME-isolated database, so an
+      // already-populated one means the isolation regressed — refuse to run
+      // against unknown data rather than skip-and-pass.
+      throw new Error(
+        'E2E_REQUIRE_SEEDED_AUTH=1 but the database already has users — gateway HOME isolation regressed?',
+      );
+    }
     console.info('[e2e setup] users already exist; skipping seed');
     return;
   }