test: interceptNetworkCall + Zod widening, PROD smoke, NextAuth write gates

- upload.smoke.spec.ts / gallery.search-filters.spec.ts: replace
  waitForResponse/text-scrape with typed interceptNetworkCall spies (status
  + JSON shape) on the real upload POST and the filtered /api/search GET.
- api.fastapi-login.spec.ts: Zod-validate the FastAPI TokenResponse and
  /auth/me UserResponse instead of loose casts. gallery.search-filters.spec.ts
  gets the same treatment for the Prisma-backed SearchResponse.
- prod.smoke.spec.ts: opt-in (PROD_BASE_URL) health + login-page check on a
  real PROD host; skips as a no-op until the PROD LXC exists (none does yet
  per `pct list` — see ROADMAP).
- viewer.write-gates.spec.ts: NextAuth (browser-session) hasWriteAccess gate
  on POST /api/faces/{id}/identify — viewer 403s, admin passes through.
  Provisioned a third, independent auth-DB user (e2e-viewer@levkine.ca,
  hasWriteAccess=false) for this via ansible's provision-punimtag-e2e-user.py
  (see that repo for the vault/Infisical/Gitea/Vaultwarden side).

e2e/tests/auth.setup.ts

@@ -3,6 +3,7 @@ import { test as setup } from '../fixtures';
 import path from 'node:path';
 
 const authFile = path.join(__dirname, '../.auth/admin.json');
+const viewerAuthFile = path.join(__dirname, '../.auth/viewer.json');
 
 setup('authenticate e2e admin', async ({ page, playkitConfig, loginPage, e2eCredentials, timings }) => {
   setup.skip(!e2eCredentials, 'E2E_ADMIN_EMAIL/PASSWORD required');
@@ -18,3 +19,23 @@ setup('authenticate e2e admin', async ({ page, playkitConfig, loginPage, e2eCred
 
   await saveStorageState(page, authFile);
 });
+
+// NextAuth auth-DB viewer (hasWriteAccess=false) — optional, only needed by
+// viewer.write-gates.spec.ts. Skips (not fails) when E2E_VIEWER_* is unset.
+setup(
+  'authenticate e2e viewer (no write access)',
+  async ({ page, playkitConfig, loginPage, e2eViewerCredentials, timings }) => {
+    setup.skip(!e2eViewerCredentials, 'E2E_VIEWER_EMAIL/PASSWORD required');
+    assertPublicHost(playkitConfig.baseUrl);
+
+    await timings.measure('setup_login_viewer', async () => {
+      await loginPage.openLogin();
+      await loginPage.signIn(e2eViewerCredentials!.email, e2eViewerCredentials!.password);
+      await page.waitForURL((url) => !url.pathname.includes('/login'), { timeout: 30_000 });
+      await page.getByLabel('Account menu').waitFor({ state: 'visible', timeout: 30_000 });
+      await waitForUrlHost(page, playkitConfig.expectedHost);
+    });
+
+    await saveStorageState(page, viewerAuthFile);
+  },
+);