feat: full plan execution - CI/CD, critical fixes, UX polish, secondary/advanced features, E2E + docs

Phase 0 (CI/CD): fix root typecheck to cover api+worker+web; reconcile migration
story into idempotent db:migrate (db:sync + db:triggers); add Gitea Actions
quality/deploy/smoke workflow; rewrite README/AGENTS/DEPLOY docs; add
requireWorkspaceAccess + recordActivityForEntity conventions.

Phase 1 (critical fixes): calendar delete + drag/resize DnD; canvas card CRUD +
bulk save + debounced autosave; logout route; graph edge workspaceId derivation;
real analytics endpoints (drop Math.random); task board droppable columns +
reorder persistence; Tiptap notes editor with sanitized HTML rendering; remove
insecure passkey auth; domain/owner scoping (IDOR) on all by-ID routes + search/
export/realtime scoping; command palette routing + agent mention fetch; agent
activity SSE handler; graph fly-to with tracked positions.

Phase 2 (UX polish): login on design system; Sonner toasts app-wide; shared
Loading/Empty/Error state components; working density/sidebarPos/reduce-motion
settings; Inter typography; consolidated status-colors lib; unified detail
routes; dashboard sort/realtime/responsive fixes; mobile responsive; a11y
(radiogroups, sanitized snippets, badge labels).

Phase 3 (features): daily notes timezone fix + delete + autosave + mood/energy
create; active-domain store + topbar picker; graph domain picker + navigable
entity links; tag assign/remove UI + server-side tag filter; real CSV export +
import validation; custom fields on tasks.

Phase 4 (advanced): migrate job worker into apps/worker (webhook delivery with
HMAC, recurring spawn, ai_dispatch disabled); webhook queue helper + entity
event enqueuing + test endpoint fix; recurring scheduledJobs pipeline; agents
CRUD + permission editing + activity filters; real notifications feed; MCP
polish (validation, error codes, domain scoping, dead sql leftover).

Phase 5 (E2E + docs): rewrite Playwright suite for the Vite SPA (15 specs, new
auth helpers, chromium-only in CI); add ephemeral-Postgres e2e CI job; rewrite
docs/API.md for the real Hono API.

e2e/helpers/auth.ts

@@ -4,8 +4,13 @@ import { TEST_USER } from './fixtures';
 /**
  * Log the test user in via the login page.
  *
- * This hits the real UI flow (fill form → submit) so the auth cookie is
- * set exactly as a real user would experience it.
+ * This exercises the real UI flow (fill form → submit) so the `session` cookie
+ * is set exactly as a real user would experience it. Successful logins navigate
+ * to the "/" dashboard.
+ *
+ * The very first login on an empty database auto-creates the admin user; when
+ * several parallel workers race that first login one of them can hit a
+ * transient server error, so the submit is retried once.
  */
 export async function login(
   page: Page,
@@ -16,17 +21,30 @@ export async function login(
   await page.goto('/login');
   await page.getByLabel('Email').fill(email);
   await page.getByLabel('Password').fill(password);
-  await page.getByRole('button', { name: /sign in/i }).click();
 
-  // Wait for navigation away from login page
-  await page.waitForURL('**/dashboard', { timeout: 15_000 });
+  let lastError: unknown;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    await page.getByRole('button', { name: /sign in/i }).click();
+    try {
+      // Wait for navigation away from the login page to the "/" dashboard.
+      await page.waitForURL('**/', { timeout: 10_000 });
+      return;
+    } catch (error) {
+      lastError = error;
+      // A transient failure leaves the form on the login page — refill and retry.
+      await page.getByLabel('Email').fill(email);
+      await page.getByLabel('Password').fill(password);
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error('Login failed');
 }
 
 /**
- * Ensure the user is logged out by clearing cookies.
+ * Log the user out by hitting the logout endpoint, then land on the login page.
  */
 export async function logout(page: Page) {
-  await page.context().clearCookies();
+  await page.request.post('/api/auth/logout');
+  await page.goto('/login');
 }
 
 /**

e2e/helpers/fixtures.ts

@@ -1,9 +1,14 @@
-import type { Page } from '@playwright/test';
-
-/** Test user credentials – matches PocketBase seed data or test fixtures. */
+/**
+ * Shared test fixtures.
+ *
+ * The first login against a fresh database auto-creates the admin user from
+ * INITIAL_ADMIN_EMAIL / INITIAL_ADMIN_PASSWORD (see apps/api/src/routes/auth.ts),
+ * so the E2E suite prefers those env vars and only falls back to hardcoded
+ * defaults when running against a pre-seeded local database.
+ */
 export const TEST_USER = {
-  email: 'test@example.com',
-  password: 'testpassword123',
+  email: process.env.E2E_EMAIL || process.env.INITIAL_ADMIN_EMAIL || 'test@example.com',
+  password: process.env.E2E_PASSWORD || process.env.INITIAL_ADMIN_PASSWORD || 'testpassword123',
 };
 
 /** Fake credentials that should always fail login. */
@@ -17,10 +22,7 @@ const ts = Date.now();
 
 export const testTasks = {
   title: `E2E Test Task ${ts}`,
-  editedTitle: `E2E Test Task Edited ${ts}`,
   description: 'This task was created by the E2E test suite.',
-  domain: 'personal',
-  priority: 'high' as const,
 };
 
 export const testHabits = {
@@ -36,14 +38,21 @@ export const testProjects = {
 export const testNotes = {
   title: `E2E Test Note ${ts}`,
   content: 'This note was created by the E2E test suite.',
-  domain: 'personal',
 };
 
-export const testReports = {
-  title: `E2E Test Report ${ts}`,
-  content: 'This report was created by the E2E test suite.',
+export const testCalendarEvents = {
+  title: `E2E Test Event ${ts}`,
+};
+
+export const testCanvas = {
+  name: `E2E Test Canvas ${ts}`,
 };
 
 export const testDomains = {
   name: `e2e-domain-${ts}`,
 };
+
+export const testWebhooks = {
+  name: `E2E Test Webhook ${ts}`,
+  url: `https://example.com/hooks/${ts}`,
+};