test: playkit v0.3.1 adoption, Zod widening, PROD smoke, NextAuth write gates (#68)

e2e/tests/upload.smoke.spec.ts

@@ -1,4 +1,4 @@
-import { assertPublicHost, waitForUrlHost } from '@levkin/playkit';
+import { assertPublicHost, interceptNetworkCall, waitForUrlHost } from '@levkin/playkit';
 import path from 'node:path';
 import { test, expect } from '../fixtures';
 
@@ -28,13 +28,23 @@ test.describe('upload @smoke', () => {
       const submit = page.getByRole('button', { name: /Submit for Review/i });
       await expect(submit).toBeEnabled({ timeout: 15_000 });
 
-      const uploadRespPromise = page.waitForResponse(
-        (r) => r.url().includes('/api/photos/upload') && r.request().method() === 'POST',
-        { timeout: 60_000 },
-      );
+      const uploadCall = interceptNetworkCall({
+        page,
+        url: '**/api/photos/upload',
+        method: 'POST',
+        timeout: 60_000,
+      });
       await submit.click();
-      const uploadResp = await uploadRespPromise;
-      expect(uploadResp.request().method()).toBe('POST');
+      const { status, responseJson } = await uploadCall;
+      expect([200, 201, 401, 403]).toContain(status);
+      if (status < 300) {
+        // viewer-frontend's own /api/photos/upload route (not FastAPI) —
+        // { message, photos: [...] } on success, see viewer-frontend route.ts.
+        expect(responseJson).toMatchObject({
+          message: expect.any(String),
+          photos: expect.any(Array),
+        });
+      }
 
       // Success banner or inline error/alert — either proves the submit path ran.
       const outcome = page