test: COD-30 stabilize focused and perf browser tests

[aakhter]

Summary

• clear shell-level Codeman auth env from Vitest setup so integration tests do not inherit a running local server's auth configuration
• update focused test expectations for current route status codes and lifecycle broadcast semantics
• update mobile keyboard test expectations for the simple-mode accessory actions
• measure browser DOMContentLoaded using browser navigation timing instead of Playwright wall-clock overhead

Verification

• npm test -- test/operation-lightspeed.test.ts test/ralph-integration.test.ts test/session-manager.test.ts
• timeout 90s npm test -- test/mobile/keyboard.test.ts
• timeout 60s npm test -- test/perf-browser.test.ts -t "DOMContentLoaded fires within threshold"
• npm run typecheck

Notes

• Server boot smoke and route harness fixes are already present in upstream as existing commits, so this PR carries only the remaining missing COD-30 test stability deltas.
• Full perf-browser baseline was not used as the gate because it timed out in this environment; the changed perf behavior is covered by the targeted DOMContentLoaded test.

Jira: COD-30