fix: update e2e tests for current UI, increase timeouts for CPU environments, and fix auth bypass bug

- Fix SKIP_MUST_CHANGE_PASSWORD not affecting login/session API responses,
  causing frontend redirect even when the env var was set after user creation
- Increase Docker Playwright timeouts (test: 600s, expect: 60s, AI processing: 300s)
  to support CPU-only self-hosted environments
- Increase default rate limit from 100 to 50000 req/min for self-hosted deployments
- Fix OCR tests: use filechooser pattern (Dropzone has no static file input),
  correct enhance checkbox default, rewrite for actual fixture behavior
- Fix remove-bg tests: update quality labels (Balanced→HD, Best→Max)
- Fix noise-removal skip guard: use waitFor() instead of instant isVisible()
- Fix automate pipeline save test: clean up stale E2E pipelines before assertion

tests/e2e/blur-faces.spec.ts

@@ -32,7 +32,7 @@ test.describe("Blur Faces tool", () => {
     // Should complete without the old "cannot identify image file" error
     await expect(
       page.getByTestId("blur-faces-download").or(page.getByText("No faces detected")).first(),
-    ).toBeVisible({ timeout: 120_000 });
+    ).toBeVisible({ timeout: 300_000 });
 
     await expect(page.locator("text=cannot identify image")).not.toBeVisible();
   });
@@ -43,6 +43,6 @@ test.describe("Blur Faces tool", () => {
 
     await page.getByTestId("blur-faces-submit").click();
 
-    await expect(page.getByText("No faces detected")).toBeVisible({ timeout: 120_000 });
+    await expect(page.getByText("No faces detected")).toBeVisible({ timeout: 300_000 });
   });
 });