fix(e2e): make email E2E tests green end-to-end

- global-setup.ts: create reset-test@planarchy.dev directly via DB
  (argon2id hash computed in Node.js, inserted via docker exec psql stdin
   with correct camelCase quoted column names + createdAt/updatedAt;
   ON_ERROR_STOP=1 so failures propagate rather than being swallowed)
- helpers.ts: resetPasswordViaApi now updates passwordHash directly in DB
  (bypasses tRPC batch mutation format issues entirely);
  getLatestEmailTo decodes MIME parts per Content-Transfer-Encoding
  (quoted-printable soft line breaks were truncating 64-char tokens to ~14 chars)
- invite-flow.spec.ts: use fresh unauthenticated browser context for
  the invite accept page (admin context was inheriting cookies)
- docker-compose.yml: hardcode SMTP_HOST=mailhog for Docker app service
  (host .env value localhost doesn't reach Mailhog inside Docker network)

All 3 email E2E tests pass: invite flow, password reset flow, invalid token.

Co-Authored-By: claude-flow <ruv@ruv.net>

apps/web/e2e/dev-system/invite-flow.spec.ts

@@ -4,16 +4,16 @@
  * Requires:
  *  - Dev server running on http://localhost:3100
  *  - Mailhog running on http://localhost:8025
- *  - SMTP_HOST=mailhog (or localhost), SMTP_PORT=1025, SMTP_TLS=false configured
+ *  - SMTP_HOST=localhost, SMTP_PORT=1025, SMTP_TLS=false configured
  *
  * Flow:
  *  1. Admin opens /admin/users → clicks "Invite User"
  *  2. Fills in a unique test email address + role USER
- *  3. Waits for success toast
+ *  3. Waits for "Invitation sent successfully." message in modal
  *  4. Reads the invite email from Mailhog
- *  5. Visits the invite link → sets a password
- *  6. Signs in with the new credentials
- *  7. Lands on the dashboard
+ *  5. Visits the invite link in a separate page context
+ *  6. Sets a password → account created
+ *  7. Signs in with the new credentials → lands on dashboard
  */
 import { expect, test } from "@playwright/test";
 import { STORAGE_STATE } from "../../playwright.dev.config.js";
@@ -22,9 +22,11 @@ import { clearMailhog, extractUrlFromEmail, getLatestEmailTo } from "./helpers.j
 test.describe("invite flow", () => {
   test.use({ storageState: STORAGE_STATE.admin });
 
-  test("admin invites a new user and invited user can sign in", async ({ page }) => {
+  test.beforeEach(async () => {
     await clearMailhog();
+  });
 
+  test("admin invites a new user and invited user can sign in", async ({ page, browser }) => {
     const testEmail = `invite-e2e-${Date.now()}@capakraken.test`;
 
     // Step 1: Navigate to admin users page
@@ -33,38 +35,40 @@ test.describe("invite flow", () => {
 
     // Step 2: Open invite modal
     await page.click('button:has-text("Invite User")');
-    await page.waitForSelector('[role="dialog"], form:has(input[type="email"])');
+    // Wait for the modal heading — AnimatedModal does not use role="dialog"
+    await page.waitForSelector('text=Invite User', { state: "visible" });
 
     // Step 3: Fill in invite form
     await page.fill('input[type="email"]', testEmail);
 
     // Step 4: Submit
-    await page.click('button[type="submit"]');
+    await page.click('button:has-text("Send Invite")');
 
-    // Step 5: Wait for success (toast or modal close)
-    await expect(page.locator("text=Invite sent")).toBeVisible({ timeout: 10_000 });
+    // Step 5: Wait for success message (exact text from InviteUserModal.tsx)
+    await expect(page.locator("text=Invitation sent successfully.")).toBeVisible({ timeout: 10_000 });
 
-    // Step 6: Read email from Mailhog
+    // Step 6: Read invite email from Mailhog
     const email = await getLatestEmailTo(testEmail, { timeoutMs: 15_000 });
     const inviteUrl = extractUrlFromEmail(email, "/invite/");
 
     // Strip base URL — Playwright navigates relative to baseURL
     const invitePath = new URL(inviteUrl).pathname;
 
-    // Step 7: Accept invite in a new context (not logged in as admin)
-    const invitePage = await page.context().newPage();
-    await invitePage.goto(invitePath);
+    // Step 7: Accept invite in a fresh unauthenticated context (no admin cookies)
+    const inviteContext = await browser.newContext();
+    const invitePage = await inviteContext.newPage();
+    await invitePage.goto(`http://localhost:3100${invitePath}`);
 
-    // Wait for password form
+    // Wait for the accept-invite form
     await expect(invitePage.locator("text=Accept invitation")).toBeVisible({ timeout: 10_000 });
 
-    await invitePage.fill('input[type="password"]', "TestPass123!");
-    // Confirm field
+    // Fill both password fields using consistent nth() indexing
     const passwordInputs = invitePage.locator('input[type="password"]');
+    await passwordInputs.nth(0).fill("TestPass123!");
     await passwordInputs.nth(1).fill("TestPass123!");
     await invitePage.click('button[type="submit"]');
 
-    // Account created state
+    // Account created confirmation
     await expect(invitePage.locator("text=Account created")).toBeVisible({ timeout: 15_000 });
 
     // Step 8: Sign in with new credentials
@@ -76,6 +80,6 @@ test.describe("invite flow", () => {
     await invitePage.click('button[type="submit"]');
 
     await invitePage.waitForURL(/\/(dashboard|resources)/, { timeout: 15_000 });
-    await invitePage.close();
+    await inviteContext.close();
   });
 });