test(e2e): parallel-safe e2e suite + API-key coverage + preview-gateway secret-drift fix

[dviejokfs]

Summary

• Parallel-safety for web/e2e: replaced CI-run-id-only resource naming with a worker+retry+random uniqueSlug() helper (the old naming was identical across every worker in one run, so it collides the moment specs run concurrently). project-create.spec.ts previously never deleted the project it created — added try/finally cleanup. Flipped playwright.config.ts to fullyParallel: true.
• Parallel-safety for apps/temps-e2e: makeRunId() now mixes in a random suffix, not just a millisecond timestamp — concurrent scenario/examples runs (parallel CI shards, two dev terminals) could otherwise land on the exact same run id.
• New coverage: web/e2e/authenticated/api-key-create.spec.ts — the security-auth subsystem's first end-to-end spec. Drives the real 3-step RBAC wizard through the UI and, critically, verifies the minted secret actually authenticates against /api/projects with a live bearer token, not just that a row was created.
• Bug fix, found while verifying the above locally: crates/temps-agents/src/preview_gateway.rs — the reconciler that keeps the shared temps-preview-gateway Docker container in sync only checked presence of PREVIEW_GATEWAY_SHARED_SECRET, never its value. That container has one fixed name shared across every local temps serve instance on a machine, so whichever instance created it first "wins" the secret — every other instance's proxy injects its own DB secret, the gateway holds a different one forever, and every preview request gets rejected with "missing or invalid X-Temps-Preview-Token" with no way to self-heal. container_matches now compares the secret value and triggers recreation on drift. Confirmed via log: preview gateway drift detected — recreating.
• Docs: web/e2e/README.md now documents the parallel-safety conventions, a coverage matrix against the feature catalog's 6 subsystems (observability, data-storage RBAC-depth, and platform-commerce webhooks/notifications are the remaining gaps), and why vercel-labs/emulate can't be wired into temps' own provider/webhook config — every such URL passes through the deliberate SSRF guard in validate_external_url, which is a security boundary, not something to route around for test convenience.

Test plan

• cd apps/temps-e2e && bun run typecheck
• cd web && bunx tsc --noEmit
• cd web && bunx eslint on all touched files (clean after --fix for formatting)
• $(command -v cargo) clippy -p temps-agents --all-targets -- -D warnings (0 warnings)
• Brought up a local instance, ran the full web/e2e suite with fullyParallel: true — 21/21 pass
• Reran the suite 2-3x back-to-back with no DB wipe — 0 leftover projects/keys each time, proving idempotency
• Ran two apps/temps-e2e scenario processes concurrently — distinct run ids despite starting in the same millisecond, both torn down cleanly
• preview_gateway.rs fix verified live: forced the drift condition, confirmed the reconciler detects and recreates

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### Testing

- **e2e:** Make console/CLI e2e suite parallel-safe, add API-key coverage