test: interceptNetworkCall + Zod widening, PROD smoke, NextAuth write gates

- upload.smoke.spec.ts / gallery.search-filters.spec.ts: replace
  waitForResponse/text-scrape with typed interceptNetworkCall spies (status
  + JSON shape) on the real upload POST and the filtered /api/search GET.
- api.fastapi-login.spec.ts: Zod-validate the FastAPI TokenResponse and
  /auth/me UserResponse instead of loose casts. gallery.search-filters.spec.ts
  gets the same treatment for the Prisma-backed SearchResponse.
- prod.smoke.spec.ts: opt-in (PROD_BASE_URL) health + login-page check on a
  real PROD host; skips as a no-op until the PROD LXC exists (none does yet
  per `pct list` — see ROADMAP).
- viewer.write-gates.spec.ts: NextAuth (browser-session) hasWriteAccess gate
  on POST /api/faces/{id}/identify — viewer 403s, admin passes through.
  Provisioned a third, independent auth-DB user (e2e-viewer@levkine.ca,
  hasWriteAccess=false) for this via ansible's provision-punimtag-e2e-user.py
  (see that repo for the vault/Infisical/Gitea/Vaultwarden side).

e2e/tests/upload.smoke.spec.ts

@@ -1,4 +1,4 @@
-import { assertPublicHost, waitForUrlHost } from '@levkin/playkit';
+import { assertPublicHost, interceptNetworkCall, waitForUrlHost } from '@levkin/playkit';
 import path from 'node:path';
 import { test, expect } from '../fixtures';
 
@@ -28,13 +28,23 @@ test.describe('upload @smoke', () => {
       const submit = page.getByRole('button', { name: /Submit for Review/i });
       await expect(submit).toBeEnabled({ timeout: 15_000 });
 
-      const uploadRespPromise = page.waitForResponse(
-        (r) => r.url().includes('/api/photos/upload') && r.request().method() === 'POST',
-        { timeout: 60_000 },
-      );
+      const uploadCall = interceptNetworkCall({
+        page,
+        url: '**/api/photos/upload',
+        method: 'POST',
+        timeout: 60_000,
+      });
       await submit.click();
-      const uploadResp = await uploadRespPromise;
-      expect(uploadResp.request().method()).toBe('POST');
+      const { status, responseJson } = await uploadCall;
+      expect([200, 201, 401, 403]).toContain(status);
+      if (status < 300) {
+        // viewer-frontend's own /api/photos/upload route (not FastAPI) —
+        // { message, photos: [...] } on success, see viewer-frontend route.ts.
+        expect(responseJson).toMatchObject({
+          message: expect.any(String),
+          photos: expect.any(Array),
+        });
+      }
 
       // Success banner or inline error/alert — either proves the submit path ran.
       const outcome = page