fix: add Origin header to E2E test requests blocked by CSRF middleware

[Copilot]

The feat/email-signup branch added app.use("*", csrf()) globally, which rejects POST requests without a matching Origin header. Playwright's page.request.post() is a raw HTTP client and does not add Origin automatically, causing every /test/login and /test/logout call to receive 403 and all E2E tests to fail at the auth step.

Changes

• e2e/auth-helpers.ts — export shared TEST_ORIGIN = "http://localhost:3000" constant; pass it as Origin header on the /test/login request
• e2e/app.spec.ts — import TEST_ORIGIN; pass it on the /test/logout request
• e2e/database-persistence.spec.ts — same as above

// before
const response = await page.request.post("/test/login");

// after
const response = await page.request.post("/test/login", {
  headers: { Origin: TEST_ORIGIN },
});

Original prompt

Fix the failing GitHub Actions workflow e2e
Analyze the workflow logs, identify the root cause of the failure, and implement a fix.
Job ID: 68545645293
Job URL: https://github.com/mahata/mlack/actions/runs/23545831252/job/68545645293

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.