test(post-prod): self-provision the smoke synthetic instead of requiring it

[izzywdev]

The authenticated post-prod journey has been red regardless of code:

POST /api/v1/security/session -> 401
Expected: 200   Received: 401
1 failed · 7 passed

The account it signs in as doesn't exist in production — so the one check that proves sign-in and Module-Federation loading actually work on the live deployment never ran.

Test 7 now bootstraps its own account

Using surfaces the SPA itself uses:

GET  /api/v1/security/email-available?email=…   -> { available }
  available  ->  POST /v1/security/signup    201, returns a LoginResponse
  otherwise  ->  POST /v1/security/session   200

First run creates postprod-smoke@fuzefront.com; every later run signs in as it. Nothing is provisioned by hand, and a rebuilt prod database heals on the next run instead of going permanently red. A 409 on signup is treated as a race between concurrent runners, not a failure — the loser falls through to signing in.

Why the password still has no in-repo fallback

izzywdev/FuzeFront is a public repository. Hard-coding the password would publish a working production login to anyone who clones it, permanently, in git history — and MFA isn't enforced, so the password alone would be enough to use it. That's strictly worse than a red check.

The old fallback (admin123) was survivable only because admin@fuzefront.dev doesn't exist in prod — initializeDatabase() runs seeds when NODE_ENV !== 'production'. Self-provisioning changes that: it creates a real account, so the credential has to be real too.

The address isn't a credential and is fixed in code — that's what makes the account stable across runs and discoverable. Only POST_PROD_PASSWORD is a secret, down from two to one.

Absent, test 7 skips loudly and is annotated as missing coverage. It never falls back to a guessable value and reports green.

Better failure messages

The single opaque 401 is now four distinguishable cases: account missing, password mismatch against an existing account, rate limit (the availability endpoint is 20/min/IP), or backend error.

Verified / not verified

• Verified: parses clean.
• Not verified: not executed against production. This environment has no frontend node_modules and no prod credential, so the first real signup happens on the next post-prod run.

To activate: set POST_PROD_PASSWORD to a generated high-entropy value. Nothing else is needed — the account creates itself.

---

Generated by Claude Code

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.