Playwright end-to-end SSO test across subdomains

[pataniaeli]

Ticket: AUTH-T96 · Epic: E13 Testing & QA · Phase: Phase 2 — Admin, Primary Admin, positions, UI, SDK, VaultZ
Priority: High · Estimate: 5 points · Labels: epic:testing, phase:2, testing, sso, e2e

Depends on:

• Non-production SSO topology: dev deployment, local hostnames, product preview domains #46 — AUTH-T34 Non-production SSO topology: dev deployment, local hostnames, product preview domains
• SDK: Next.js helpers (proxy/middleware, requireSession, position guards, URLs) #71 — AUTH-T59 SDK: Next.js helpers (proxy/middleware, requireSession, position guards, URLs)
• Global logout, sign out everywhere, and admin revocation #42 — AUTH-T30 Global logout, sign out everywhere, and admin revocation

Spin up SGAuth and two minimal product stubs (using the SDK) on auth.sga.localhost, a.sga.localhost, b.sga.localhost in CI. Scenarios: login at auth → both products see the session; position assigned by an admin → product B gates a page accordingly; logout on product A → product B is logged out; expired session → redirect to login with the correct redirect param; open-redirect attempts rejected.

Acceptance criteria

• Playwright job green in CI with traces on failure; run time under 4 minutes.

_{Generated from the SGAuth design (docs/sgauth-design in SGAOperations/auth). SGAuth is built on Neon and does not use Supabase.}