fix(12): unblock CI security + harness jobs

security/gitleaks: allowlist apps/api/tests/routes/setup.test.ts — synthetic
  VAPID test pair (verified absent from .env), same class as existing fixture
  allowlist entries.
security/audit: waive GHSA-88fw-hqm2-52qc (hono CORS) — not exploitable, the
  app uses no hono cors() middleware; newly-published vs pinned hono 4.12.23.
harness/e2e: seed app_config.setup_complete='true' + a dev-admin credential in
  global-setup so the Phase-12 setup gate no longer redirects every spec to
  /setup (was causing all 95 e2e failures) and no onboarding banner renders.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitleaks.toml

@@ -22,3 +22,7 @@ paths = ['''apps/api/\.env\.spike$''']
 [[allowlists]]
 description = "apps/api/tests/broker/crypto.test.ts — synthetic AES-256-GCM test key assigned to process.env.APP_PASSWORD_ENCRYPTION_KEY in a Vitest beforeAll; not a real credential"
 paths = ['''apps/api/tests/broker/crypto\.test\.ts''']
+
+[[allowlists]]
+description = "apps/api/tests/routes/setup.test.ts — synthetic VAPID public/private test pair used to set process.env.VAPID_* in the setup-route tests; not a real credential (verified not present in .env)"
+paths = ['''apps/api/tests/routes/setup\.test\.ts''']

apps/pwa/e2e/global-setup.ts

@@ -128,6 +128,24 @@ export default async function globalSetup(): Promise<void> {
        ON DUPLICATE KEY UPDATE is_admin=true`,
     );
 
+    // Phase 12: the setup-wizard gate (App.tsx) redirects EVERY route to /setup when
+    // app_config.setup_complete !== 'true' (isSetupLocked() === false). The e2e suite
+    // drives the real app (calendar/admin/lists/timezone), so without marking setup
+    // complete here every spec is redirected to the wizard and fails. Mark complete and
+    // seed a credential for the dev admin (id=1) so needsProviderSetup is false and the
+    // Phase-12 onboarding SetupBanner does not render — mirroring a post-wizard state.
+    // The credential blob is a synthetic placeholder; e2e read flows never decrypt it
+    // (the pre-Phase-12 suite ran with no credential at all). Idempotent upserts.
+    await conn.execute(
+      "INSERT INTO app_config (`key`, value) VALUES ('setup_complete', 'true') " +
+        "ON DUPLICATE KEY UPDATE value='true'",
+    );
+    await conn.execute(
+      `INSERT INTO member_credentials (user_id, encrypted_password, fastmail_email, provider_type)
+       VALUES (1, '{"iv":"e2e","authTag":"e2e","ciphertext":"e2e"}', 'dev@e2e.local', 'caldav')
+       ON DUPLICATE KEY UPDATE fastmail_email='dev@e2e.local'`,
+    );
+
     // CI guard (Pitfall 4): ensure calendar row id=10 exists before inserting events.
     // INSERT IGNORE is a no-op if the row already exists (dev DB), creates it if not (CI fresh DB).
     await conn.execute(

scripts/audit-allowlist.json

@@ -3,5 +3,10 @@
     "reason": "esbuild integrity-check advisory; transitive dev-only via drizzle-kit/vitest/vite; not in the production runtime — esbuild never runs in the shipped image; patched in esbuild >=0.28.1, will resolve when drizzle-kit bumps the transitive pin",
     "reviewer": "luc",
     "expires": "2026-09-01"
+  },
+  "GHSA-88fw-hqm2-52qc": {
+    "reason": "hono CORS-middleware advisory: reflects any Origin with credentials when cors() origin defaults to wildcard. NOT exploitable here — FamilySync never uses hono's cors() middleware (grep of apps/api/src is empty); the affected code path is unreachable. Newly-published advisory against the pinned hono 4.12.23 (CLAUDE.md). Re-evaluate when hono is bumped to the patched release.",
+    "reviewer": "luc",
+    "expires": "2026-09-01"
   }
 }