fix(07-02): fail-closed guard on global-setup seed (CR-01, data-loss prevention)

global-setup.ts TRUNCATEs four tables against whatever DB_* points at, with no
production guard — an operator with prod DB_* still exported could wipe lists/
list_items/list_shares/calendar_events. The README promised a DEV_AUTH_BYPASS
guardrail the code never enforced. Adds a fail-closed guard mirroring
apps/api/src/auth/devBypass.ts: hard NODE_ENV==='production' check first, then
require DEV_AUTH_BYPASS==='true' before opening any DB connection. README updated
with the test-process env requirement (run command + CI runner env).

Verified: guard throws without DEV_AUTH_BYPASS; full 58-test suite passes with it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/pwa/e2e/README.md

@@ -22,7 +22,17 @@ The stack must include:
 
 ## Run Commands
 
+`global-setup.ts` is **fail-closed**: it refuses to run (throws before any DB write) unless
+`DEV_AUTH_BYPASS=true` **and** `NODE_ENV !== 'production'` — the same handshake the API uses
+(see Security Guardrail). So `DEV_AUTH_BYPASS=true` must be exported in the **test process**
+environment (not only the API's). Source the DB credentials from the repo-root `.env` and point
+`DB_HOST` at the host-side MariaDB:
+
 ```bash
+# Load DB creds, then run. DEV_AUTH_BYPASS=true is required by the global-setup guard.
+set -a; source .env; set +a
+export DEV_AUTH_BYPASS=true DB_HOST=127.0.0.1 DB_PORT=3306
+
 # Full suite — both iPhone (WebKit) and Pixel (Chromium) profiles
 pnpm --filter @familysync/pwa test:e2e
 
@@ -82,6 +92,7 @@ This harness uses **no `storageState` file** (D-01). There is no checked-in sess
 
 Before any spec runs, `global-setup.ts`:
 
+0. **Fail-closed guard:** throws immediately if `NODE_ENV === 'production'` or `DEV_AUTH_BYPASS !== 'true'`, before opening any DB connection — so the TRUNCATE/seed can never run against a production (or unconfirmed) database.
 1. **Polls `PLAYWRIGHT_BASE_URL/health`** until 200 OK (60s timeout, then fails fast with a clear error).
 2. **Truncates** `list_items`, `list_shares`, `lists`, `calendar_events` (FK checks disabled around TRUNCATE).
 3. **Seeds** deterministic fixtures for Dev User 1:
@@ -97,7 +108,7 @@ This seeding is idempotent — two consecutive runs leave the same row counts, n
 Phase 8 (Gitea CI) runs these specs unchanged as a PR UI-regression step. The CI workflow owns:
 - Bringing up the dev stack (compose) with `DEV_AUTH_BYPASS=true`
 - Waiting for the MariaDB health check before starting the API
-- Setting `PLAYWRIGHT_BASE_URL` and `DB_*` env vars in the runner environment
+- Setting `PLAYWRIGHT_BASE_URL`, `DB_*`, and `DEV_AUTH_BYPASS=true` env vars in the runner environment (the global-setup guard requires `DEV_AUTH_BYPASS=true` in the Playwright process, not only the API's)
 
 The harness handles its own readiness gate (`/health` poll) once the runner sets things up. No changes to spec files are needed for CI — the harness is stack-agnostic via env vars.
 

apps/pwa/e2e/global-setup.ts

@@ -23,6 +23,26 @@
 import mysql from 'mysql2/promise'
 
 export default async function globalSetup(): Promise<void> {
+  // ── Step 0: Fail-closed environment guard (CR-01 — data-loss prevention) ─────
+  // This setup TRUNCATEs four tables against whatever DB_* points at. Mirror the
+  // hard guard in apps/api/src/auth/devBypass.ts so an operator with prod DB_*
+  // still exported can never wipe production data.
+  //   1. NODE_ENV === 'production' is the hard FIRST guard (checked before any
+  //      other env var), matching devBypass.ts.
+  //   2. The harness contract requires DEV_AUTH_BYPASS=true (the same flag the API
+  //      needs to serve Dev User 1) — refuse to seed without it.
+  if (process.env.NODE_ENV === 'production') {
+    throw new Error(
+      'global-setup refused: NODE_ENV=production. The E2E seed TRUNCATEs tables and must never run against production.',
+    )
+  }
+  if (process.env.DEV_AUTH_BYPASS !== 'true') {
+    throw new Error(
+      'global-setup refused: DEV_AUTH_BYPASS is not "true". The harness only runs against a dev-bypass stack; ' +
+        'refusing to TRUNCATE/seed an unconfirmed database. Export DEV_AUTH_BYPASS=true (and point DB_* at the dev DB) to proceed.',
+    )
+  }
+
   // ── Step 1: Readiness gate (D-08) ───────────────────────────────────────────
   const baseURL = process.env.PLAYWRIGHT_BASE_URL ?? 'http://localhost:5173'
   const deadline = Date.now() + 60_000