fix(12): unblock CI security + harness jobs

security/gitleaks: allowlist apps/api/tests/routes/setup.test.ts — synthetic
  VAPID test pair (verified absent from .env), same class as existing fixture
  allowlist entries.
security/audit: waive GHSA-88fw-hqm2-52qc (hono CORS) — not exploitable, the
  app uses no hono cors() middleware; newly-published vs pinned hono 4.12.23.
harness/e2e: seed app_config.setup_complete='true' + a dev-admin credential in
  global-setup so the Phase-12 setup gate no longer redirects every spec to
  /setup (was causing all 95 e2e failures) and no onboarding banner renders.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/audit-allowlist.json

@@ -3,5 +3,10 @@
     "reason": "esbuild integrity-check advisory; transitive dev-only via drizzle-kit/vitest/vite; not in the production runtime — esbuild never runs in the shipped image; patched in esbuild >=0.28.1, will resolve when drizzle-kit bumps the transitive pin",
     "reviewer": "luc",
     "expires": "2026-09-01"
+  },
+  "GHSA-88fw-hqm2-52qc": {
+    "reason": "hono CORS-middleware advisory: reflects any Origin with credentials when cors() origin defaults to wildcard. NOT exploitable here — FamilySync never uses hono's cors() middleware (grep of apps/api/src is empty); the affected code path is unreachable. Newly-published advisory against the pinned hono 4.12.23 (CLAUDE.md). Re-evaluate when hono is bumped to the patched release.",
+    "reviewer": "luc",
+    "expires": "2026-09-01"
   }
 }