Fix Playwright cookie auth in Docker CI environment

Both test drivers (surface-test-driver.js, e2e-smoke-driver.js) set
the arm_token cookie using domain: hostname, which fails in Docker
where the hostname is a DNS name like "armature". Playwright's
addCookies with a bare domain doesn't reliably match the request
origin in this environment.

Switch to url-based cookie setting which matches the full origin
and works reliably across local and Docker environments. Also wait
for .sw-topbar with waitForSelector instead of immediate DOM check
to handle Preact SPA boot timing.

This fixes the v0.7.2 "Run All button not found" issue — the root
cause was auth redirect to /login, not a rendering problem.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ci/e2e-smoke-driver.js

@@ -97,12 +97,11 @@ async function discoverSurfaces(page) {
   const browser = await chromium.launch({ headless: true });
   const context = await browser.newContext();
 
-  // Set auth cookie
+  // Set auth cookie — use url instead of domain for reliable matching
   await context.addCookies([{
     name: 'arm_token',
     value: TOKEN,
-    domain: new URL(SERVER).hostname,
+    url: SERVER,
-    path: '/',
   }]);
 
   const page = await context.newPage();
@@ -145,10 +144,11 @@ async function discoverSurfaces(page) {
       process.stdout.write(`  ${surface.id} (${surface.route}) ... `);
       await page.goto(url, { waitUntil: 'networkidle', timeout: 30000 });
 
-      // Assert 1: Shell topbar exists
+      // Assert 1: Shell topbar renders (Preact SPA — wait for it to mount)
-      const topbar = await page.$('.sw-topbar');
+      const topbar = await page.waitForSelector('.sw-topbar', { timeout: 15000 })
+        .catch(() => null);
       if (!topbar) {
-        throw new Error('Shell topbar (.sw-topbar) not found');
+        throw new Error('Shell topbar (.sw-topbar) not found after 15s');
       }
 
       // Assert 2: Home link exists (favicon link or any link to /)

ci/surface-test-driver.js

@@ -33,12 +33,12 @@ if (!TOKEN) {
   const browser = await chromium.launch({ headless: true });
   const context = await browser.newContext();
 
-  // Set auth cookie — name must match server's SetCookie ("arm_token")
+  // Set auth cookie — use url instead of domain for reliable matching
+  // in Docker/CI where hostname is a Docker DNS name (e.g. "armature")
   await context.addCookies([{
     name: 'arm_token',
     value: TOKEN,
-    domain: new URL(SERVER).hostname,
+    url: SERVER,
-    path: '/',
   }]);
 
   const page = await context.newPage();