Fix CI auth: set cookie via /api/v1/health, not /login

Navigating to /login triggers SDK boot which loads stale localStorage
tokens, attempts /auth/refresh (fails with 401), and clears all auth
state including the cookie we just set.

Fix: navigate to /api/v1/health (JSON endpoint, no SPA boot), set
arm_token cookie via document.cookie, then navigate to real surfaces.
The Go page-auth middleware reads the cookie on subsequent requests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ci/surface-test-driver.js

@@ -35,19 +35,14 @@ if (!TOKEN) {
 
   const page = await context.newPage();
 
-  // Authenticate via page context — inject tokens into localStorage
-  // and set the arm_token cookie via JS. Playwright's addCookies
-  // doesn't reliably work with SameSite=Strict cookies in Docker.
+  // Authenticate via page context — navigate to a non-SPA endpoint,
+  // set the arm_token cookie via document.cookie. Cannot use /login
+  // (SDK boot clears stale tokens) or addCookies (SameSite=Strict
+  // fails in Docker DNS environments).
   console.log('Setting up auth...');
-  await page.goto(SERVER + '/login', { waitUntil: 'networkidle', timeout: 30000 });
+  await page.goto(SERVER + '/api/v1/health', { waitUntil: 'networkidle', timeout: 30000 });
   await page.evaluate((token) => {
-    localStorage.setItem('arm_auth', JSON.stringify({
-      accessToken: token,
-      refreshToken: token,
-      user: null,
-      cookieMaxAge: 604800,
-    }));
-    document.cookie = `arm_token=${token}; path=/; max-age=604800; SameSite=Strict`;
+    document.cookie = `arm_token=${token}; path=/; max-age=604800`;
   }, TOKEN);
 
   // Collect console errors