fix: E2E test isolation and analytics consent bugs

- Isolate test web server on port 2349 so E2E tests run alongside Docker
- Use fresh SQLite database per test run via DB_PATH, fixing missing
  roles/audit_log tables from stale migration state
- Fix analytics consent redirect loop when ANALYTICS_ENABLED=false by
  auto-declining consent instead of bare redirect
- Dismiss analytics consent via API in auth setup and RBAC test user
  creation so the consent page never blocks UI tests
- Make Vite port and proxy target configurable via env vars

tests/e2e/rbac.spec.ts

@@ -68,6 +68,19 @@ async function ensureTestUser(adminToken: string): Promise<void> {
   if (!changeRes.ok) {
     throw new Error(`Failed to clear mustChangePassword: ${changeRes.status}`);
   }
+
+  // Re-login (change-password invalidates sessions) and dismiss analytics consent
+  const reLogin = await fetch(`${API}/api/auth/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ username: TEST_USER, password: TEST_PASSWORD }),
+  });
+  const reLoginData = await reLogin.json();
+  await fetch(`${API}/api/v1/user/analytics`, {
+    method: "PUT",
+    headers: authJson(reLoginData.token),
+    body: JSON.stringify({ enabled: false }),
+  });
 }
 
 /** Delete the test user if it exists. */
@@ -204,6 +217,19 @@ base.describe("RBAC - Editor sees collaborative tabs", () => {
         newPassword: "EditorTest1",
       }),
     });
+
+    // Re-login and dismiss analytics consent
+    const reLogin = await fetch(`${API}/api/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ username: "editortest", password: "EditorTest1" }),
+    });
+    const reLoginData = await reLogin.json();
+    await fetch(`${API}/api/v1/user/analytics`, {
+      method: "PUT",
+      headers: authJson(reLoginData.token),
+      body: JSON.stringify({ enabled: false }),
+    });
   });
 
   base.afterAll(async () => {