Fix CI auth: set cookie via /api/v1/health, not /login

Navigating to /login triggers SDK boot which loads stale localStorage
tokens, attempts /auth/refresh (fails with 401), and clears all auth
state including the cookie we just set.

Fix: navigate to /api/v1/health (JSON endpoint, no SPA boot), set
arm_token cookie via document.cookie, then navigate to real surfaces.
The Go page-auth middleware reads the cookie on subsequent requests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ci/e2e-smoke-driver.js

@@ -100,20 +100,18 @@ async function discoverSurfaces(page) {
   const page = await context.newPage();
 
   // ── Authenticate via page context ─────────
-  // Navigate to login first, then inject tokens into localStorage
+  // Navigate to health endpoint (no SPA boot, no SDK interference),
-  // and set the arm_token cookie via JS — same mechanism the login
+  // set the arm_token cookie via document.cookie, then navigate to
-  // page uses. Playwright's addCookies doesn't reliably work with
+  // real surfaces. The Go page-auth middleware reads this cookie.
-  // SameSite=Strict cookies in Docker DNS environments.
+  //
+  // We cannot use /login because the SDK boots, sees stale tokens in
+  // localStorage, tries /auth/refresh, fails, and clears the cookie.
+  // We cannot use Playwright's addCookies because SameSite=Strict
+  // cookies set externally aren't sent in Docker DNS environments.
   console.log('Setting up auth...');
-  await page.goto(SERVER + '/login', { waitUntil: 'networkidle', timeout: 30000 });
+  await page.goto(SERVER + '/api/v1/health', { waitUntil: 'networkidle', timeout: 30000 });
   await page.evaluate((token) => {
-    localStorage.setItem('arm_auth', JSON.stringify({
+    document.cookie = `arm_token=${token}; path=/; max-age=604800`;
-      accessToken: token,
-      refreshToken: token,
-      user: null,
-      cookieMaxAge: 604800,
-    }));
-    document.cookie = `arm_token=${token}; path=/; max-age=604800; SameSite=Strict`;
   }, TOKEN);
 
   // ── Discover surfaces ─────────────────────

ci/surface-test-driver.js

@@ -35,19 +35,14 @@ if (!TOKEN) {
 
   const page = await context.newPage();
 
-  // Authenticate via page context — inject tokens into localStorage
+  // Authenticate via page context — navigate to a non-SPA endpoint,
-  // and set the arm_token cookie via JS. Playwright's addCookies
+  // set the arm_token cookie via document.cookie. Cannot use /login
-  // doesn't reliably work with SameSite=Strict cookies in Docker.
+  // (SDK boot clears stale tokens) or addCookies (SameSite=Strict
+  // fails in Docker DNS environments).
   console.log('Setting up auth...');
-  await page.goto(SERVER + '/login', { waitUntil: 'networkidle', timeout: 30000 });
+  await page.goto(SERVER + '/api/v1/health', { waitUntil: 'networkidle', timeout: 30000 });
   await page.evaluate((token) => {
-    localStorage.setItem('arm_auth', JSON.stringify({
+    document.cookie = `arm_token=${token}; path=/; max-age=604800`;
-      accessToken: token,
-      refreshToken: token,
-      user: null,
-      cookieMaxAge: 604800,
-    }));
-    document.cookie = `arm_token=${token}; path=/; max-age=604800; SameSite=Strict`;
   }, TOKEN);
 
   // Collect console errors