fix(12): unblock CI security + harness jobs

security/gitleaks: allowlist apps/api/tests/routes/setup.test.ts — synthetic
  VAPID test pair (verified absent from .env), same class as existing fixture
  allowlist entries.
security/audit: waive GHSA-88fw-hqm2-52qc (hono CORS) — not exploitable, the
  app uses no hono cors() middleware; newly-published vs pinned hono 4.12.23.
harness/e2e: seed app_config.setup_complete='true' + a dev-admin credential in
  global-setup so the Phase-12 setup gate no longer redirects every spec to
  /setup (was causing all 95 e2e failures) and no onboarding banner renders.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/pwa/e2e/global-setup.ts

@@ -128,6 +128,24 @@ export default async function globalSetup(): Promise<void> {
        ON DUPLICATE KEY UPDATE is_admin=true`,
     );
 
+    // Phase 12: the setup-wizard gate (App.tsx) redirects EVERY route to /setup when
+    // app_config.setup_complete !== 'true' (isSetupLocked() === false). The e2e suite
+    // drives the real app (calendar/admin/lists/timezone), so without marking setup
+    // complete here every spec is redirected to the wizard and fails. Mark complete and
+    // seed a credential for the dev admin (id=1) so needsProviderSetup is false and the
+    // Phase-12 onboarding SetupBanner does not render — mirroring a post-wizard state.
+    // The credential blob is a synthetic placeholder; e2e read flows never decrypt it
+    // (the pre-Phase-12 suite ran with no credential at all). Idempotent upserts.
+    await conn.execute(
+      "INSERT INTO app_config (`key`, value) VALUES ('setup_complete', 'true') " +
+        "ON DUPLICATE KEY UPDATE value='true'",
+    );
+    await conn.execute(
+      `INSERT INTO member_credentials (user_id, encrypted_password, fastmail_email, provider_type)
+       VALUES (1, '{"iv":"e2e","authTag":"e2e","ciphertext":"e2e"}', 'dev@e2e.local', 'caldav')
+       ON DUPLICATE KEY UPDATE fastmail_email='dev@e2e.local'`,
+    );
+
     // CI guard (Pitfall 4): ensure calendar row id=10 exists before inserting events.
     // INSERT IGNORE is a no-op if the row already exists (dev DB), creates it if not (CI fresh DB).
     await conn.execute(