test: playkit v0.3.1 adoption, Zod widening, PROD smoke, NextAuth write gates (#68)

e2e/fixtures.ts

@@ -9,6 +9,7 @@ import { playkitEnvFromProcess } from './env-defaults';
 import { LoginPage } from './pages/LoginPage';
 import { AccountMenu } from './pages/AccountMenu';
 import { RegisterPage } from './pages/RegisterPage';
+import { ManageUsersPanel } from './pages/ManageUsersPanel';
 
 const runtime = createPlaykitRuntime(playkitEnvFromProcess());
 
@@ -16,7 +17,9 @@ type PunimtagFixtures = PlaykitFixtures & {
   loginPage: LoginPage;
   accountMenu: AccountMenu;
   registerPage: RegisterPage;
+  manageUsersPanel: ManageUsersPanel;
   e2eCredentials: { email: string; password: string } | null;
+  e2eViewerCredentials: { email: string; password: string } | null;
   mail: MailInbox | null;
 };
 
@@ -32,6 +35,8 @@ export const test = base.extend<PunimtagFixtures>({
     use(new AccountMenu(page, playkitConfig.baseUrl)),
   registerPage: async ({ page, playkitConfig }, use) =>
     use(new RegisterPage(page, playkitConfig.baseUrl)),
+  manageUsersPanel: async ({ page, playkitConfig }, use) =>
+    use(new ManageUsersPanel(page, playkitConfig.baseUrl)),
 
   e2eCredentials: async ({}, use) => {
     const email = process.env.E2E_ADMIN_EMAIL || process.env.E2E_EMAIL || '';
@@ -39,6 +44,14 @@ export const test = base.extend<PunimtagFixtures>({
     await use(email && password ? { email, password } : null);
   },
 
+  // NextAuth auth-DB viewer (hasWriteAccess=false) — distinct from
+  // E2E_API_VIEWER_* (FastAPI bearer). See docs/hardening/SECRETS.md (ansible).
+  e2eViewerCredentials: async ({}, use) => {
+    const email = process.env.E2E_VIEWER_EMAIL || '';
+    const password = process.env.E2E_VIEWER_PASSWORD || '';
+    await use(email && password ? { email, password } : null);
+  },
+
   mail: async ({ playkitLog }, use) => {
     await use(createMailInbox(process.env, playkitLog.child({ component: 'mail' })));
   },