test(e2e): provision RBAC role users + per-role sessions; un-quarantine rbac-403

[rubenvdlinde]

Enabler B of the remaining-work plan.

What it adds

globalSetup now provisions the four RBAC fixture users (rbac-owner / -editor / -viewer / -outsider, with the credentials the specs already expected) and their groups through the OCS provisioning API, then mints one stored session per role under tests/e2e/.auth/{id}.json.

Doing it there rather than in the specs is the whole point: the permission suites used to form-log-in per test, and consecutive logins from a single IP trip Nextcloud's brute-force throttle. Once it fires, every later spec falls back to /login and the run goes false-red. Each role now logs in exactly once, sequentially, with spacing.

Two things measured rather than assumed while building it:

• OCS v2 answers statuscode: 200 on user creation; the v1 shape answers 100 (created) / 102 (exists). The check accepts all three, so a re-run is idempotent instead of noisy.
• Waiting on #header after submit is unreliable — the landing page differs per user and the selector races the theming bundle. It waits on the URL leaving /login instead, with a 60s budget, because a throttled login stalls well past anything shorter.

Provisioning failures are logged, never thrown: a missing RBAC user must not take down suites that don't need one.

rbac-403 — 2/2 green

Both documented blockers are gone:

• it attaches the stored outsider session instead of logging in per test;
• its deny assertions targeted [data-app-slug="…"] and [data-testid="builder-host-hello-world"]. Neither is emitted anywhere in src/ — BuilderHost.vue stamps data-testid="openbuild-builder-host", with no slug — so both counts were 0 even for an admin who can see the app, and the assertions proved nothing.

They now assert what an outsider actually gets, measured against the instance: an application list with no cards and no mention of the slug, and an "App not found" screen with no builder host mounted.

Verification

rbac-403 2/2 green, twice. All four role sessions mint cleanly from a cold .auth/. ESLint clean apart from the repo-wide pre-existing n/no-unpublished-import.

Unblocked but not yet claimed in this PR: versionRouting 9.2 (viewer) and schema-access-scopes-rbac (needs role grants on a fixture app on top of the sessions).