Fix CI auth: inject token via localStorage + document.cookie

Playwright's addCookies (both domain-based and url-based) fails to
send SameSite=Strict cookies in Docker DNS environments. The server
middleware reads arm_token from cookies, but the cookie is originally
set by client-side JS (document.cookie with SameSite=Strict).

New approach: navigate to /login first, then inject the token into
localStorage (key: arm_auth) and set the cookie via document.cookie
in page context — exactly how the real login flow works. This ensures
the cookie attributes match what the server expects.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ci/e2e-smoke-driver.js

@@ -97,19 +97,28 @@ async function discoverSurfaces(page) {
   const browser = await chromium.launch({ headless: true });
   const context = await browser.newContext();
 
-  // Set auth cookie — use url instead of domain for reliable matching
-  await context.addCookies([{
-    name: 'arm_token',
-    value: TOKEN,
-    url: SERVER,
-  }]);
-
   const page = await context.newPage();
 
+  // ── Authenticate via page context ─────────
+  // Navigate to login first, then inject tokens into localStorage
+  // and set the arm_token cookie via JS — same mechanism the login
+  // page uses. Playwright's addCookies doesn't reliably work with
+  // SameSite=Strict cookies in Docker DNS environments.
+  console.log('Setting up auth...');
+  await page.goto(SERVER + '/login', { waitUntil: 'networkidle', timeout: 30000 });
+  await page.evaluate((token) => {
+    localStorage.setItem('arm_auth', JSON.stringify({
+      accessToken: token,
+      refreshToken: token,
+      user: null,
+      cookieMaxAge: 604800,
+    }));
+    document.cookie = `arm_token=${token}; path=/; max-age=604800; SameSite=Strict`;
+  }, TOKEN);
+
   // ── Discover surfaces ─────────────────────
   console.log('Discovering surfaces...');
 
-  // Navigate to a page first so cookies are sent with API call
   await page.goto(SERVER + '/admin', { waitUntil: 'networkidle', timeout: 30000 });
 
   const surfaces = await discoverSurfaces(page);

ci/surface-test-driver.js

@@ -33,16 +33,23 @@ if (!TOKEN) {
   const browser = await chromium.launch({ headless: true });
   const context = await browser.newContext();
 
-  // Set auth cookie — use url instead of domain for reliable matching
-  // in Docker/CI where hostname is a Docker DNS name (e.g. "armature")
-  await context.addCookies([{
-    name: 'arm_token',
-    value: TOKEN,
-    url: SERVER,
-  }]);
-
   const page = await context.newPage();
 
+  // Authenticate via page context — inject tokens into localStorage
+  // and set the arm_token cookie via JS. Playwright's addCookies
+  // doesn't reliably work with SameSite=Strict cookies in Docker.
+  console.log('Setting up auth...');
+  await page.goto(SERVER + '/login', { waitUntil: 'networkidle', timeout: 30000 });
+  await page.evaluate((token) => {
+    localStorage.setItem('arm_auth', JSON.stringify({
+      accessToken: token,
+      refreshToken: token,
+      user: null,
+      cookieMaxAge: 604800,
+    }));
+    document.cookie = `arm_token=${token}; path=/; max-age=604800; SameSite=Strict`;
+  }, TOKEN);
+
   // Collect console errors
   const consoleErrors = [];
   page.on('console', msg => {