test(e2e): fix dev-system test suite — storageState + strict-mode + signout

Fixes 8 failures from the first test run:

1. Rate limiter exhaustion (5/8 failures)
   Admin was logged in 9× across the suite, hitting the 5/15min auth
   limit. Fix: global-setup.ts logs in once per role and saves storage
   state; all non-login tests use storageState so they skip the form.
   Total admin logins per suite run: 3 (global setup + 2 explicit tests).

2. Strict-mode violations (2/8 failures)
   toBeVisible() matched 3 email cells / 2 permission-error nodes.
   Fix: .first() on both locators.

3. Auth.js v5 signout confirmation page (1/8 failures)
   GET /auth/signout renders a confirm form rather than immediately
   redirecting. Fix: signOut() helper clicks the submit button.

Note: running the suite right after a previous run may fail if the
in-memory rate limit hasn't reset (15-min window). Restart the dev
server, or add E2E_TEST_MODE=true to apps/web/.env.local to bypass.

Co-Authored-By: claude-flow <ruv@ruv.net>

apps/web/e2e/dev-system/helpers.ts

@@ -17,7 +17,12 @@ export async function signIn(page: Page, email: string, password: string) {
 
 export async function signOut(page: Page) {
   await page.goto("/auth/signout");
-  // Wait for redirect back to signin
+  // Auth.js v5 renders a confirmation page at /auth/signout before signing out.
+  // Click the submit button if a form is present.
+  const confirmBtn = page.locator('button[type="submit"]').first();
+  if (await confirmBtn.isVisible({ timeout: 3000 }).catch(() => false)) {
+    await confirmBtn.click();
+  }
   await page.waitForURL(/\/auth\/signin/, { timeout: 10000 });
 }