Expand authentication E2E coverage and stabilize test setup

[Portals]

Add regression coverage for Gamma’s existing authentication, authorization, registration, and password-recovery behavior. All changes are confined to E2E setup, helpers, and tests; application code is unchanged.

• Cover OAuth flows with and without PKCE, Basic and POST client authentication, ID-token signature and claims verification, invalid exchanges and code replay, consent reuse and withdrawal, client API isolation, group restrictions, client ownership, secret rotation, and logout cookie invalidation.
• Follow registration and password-reset links from the real Gotify mock container’s Go-formatted logs, using bounded reads and escape-aware parsing instead of retrieving activation tokens from PostgreSQL. Configure Gotify’s port and mail-size limit explicitly.
• Require a successful login page and its referenced scripts/styles before starting browser workflows. Keep readiness connections scoped to each container and preserve HTTP/2 for browser traffic.
• Wait for the new allow-list row before logging out in registration and activation-code tests. Waiting for the already-current URL allowed logout to overtake the pending update.
• Add a separate HTTP/1.1 and HTTP/2 cold-start probe that captures pending requests, browser network events, and container diagnostics before teardown.