test: playkit v0.3.1 adoption, Zod widening, PROD smoke, NextAuth write gates (#68)

e2e/tests/auth.setup.ts

@@ -3,6 +3,7 @@ import { test as setup } from '../fixtures';
 import path from 'node:path';
 
 const authFile = path.join(__dirname, '../.auth/admin.json');
+const viewerAuthFile = path.join(__dirname, '../.auth/viewer.json');
 
 setup('authenticate e2e admin', async ({ page, playkitConfig, loginPage, e2eCredentials, timings }) => {
   setup.skip(!e2eCredentials, 'E2E_ADMIN_EMAIL/PASSWORD required');
@@ -18,3 +19,23 @@ setup('authenticate e2e admin', async ({ page, playkitConfig, loginPage, e2eCred
 
   await saveStorageState(page, authFile);
 });
+
+// NextAuth auth-DB viewer (hasWriteAccess=false) — optional, only needed by
+// viewer.write-gates.spec.ts. Skips (not fails) when E2E_VIEWER_* is unset.
+setup(
+  'authenticate e2e viewer (no write access)',
+  async ({ page, playkitConfig, loginPage, e2eViewerCredentials, timings }) => {
+    setup.skip(!e2eViewerCredentials, 'E2E_VIEWER_EMAIL/PASSWORD required');
+    assertPublicHost(playkitConfig.baseUrl);
+
+    await timings.measure('setup_login_viewer', async () => {
+      await loginPage.openLogin();
+      await loginPage.signIn(e2eViewerCredentials!.email, e2eViewerCredentials!.password);
+      await page.waitForURL((url) => !url.pathname.includes('/login'), { timeout: 30_000 });
+      await page.getByLabel('Account menu').waitFor({ state: 'visible', timeout: 30_000 });
+      await waitForUrlHost(page, playkitConfig.expectedHost);
+    });
+
+    await saveStorageState(page, viewerAuthFile);
+  },
+);