test(e2e): site editor over a deco serve connect link

[tlgimenes]

Part of the v8 Studio stack, split from #7728, #7770 and #7766 (closed). Base: #7796. The top of the stack, #7843, has the same code as those three PRs combined.

Adds a deco serve stand-in built from @decocms/blocks' content protocol and a spec that opens /site-editor through a connect link. The e2e package gains the @decocms/blocks dependency (bun.lock e2e hunk) and the ban-e2e-app-imports allowlist entry.

Merge after the API, daemon and web stacks (and after #7841). This PR's own diff is only its 5 files.

What to look at

• Why the e2e package may import @decocms/blocks: it is the published Blocks framework, not Studio source; its content protocol is the wire contract the spec drives (see the comment in plugins/ban-e2e-app-imports.js).

Stack

e2e track: previous: #7841 · next: #7843

🤖 Generated with Claude Code

https://claude.ai/code/session_01WNwbSEePYNcY5YCgqZURig

---

Summary by cubic

Adds a deco serve stand-in and an e2e spec that opens /site-editor through a connect link and drives the site editor against it.

• The stand-in wraps the published @decocms/blocks content protocol handler and filesystem storage over real HTTP, no token, like the CLI serves one.
• The spec covers accountless and signed-in flows, edits to a field, a Lazy<T> field and a secret (the plaintext never leaves the browser), CMS.json creation and concurrent writer guards, waiting for a stopped server and reconnecting, refusing off-machine endpoints, and the org rail.
• @decocms/blocks is added to the e2e package and to the ban-e2e-app-imports allowlist.

^{Written for commit f318f56. Summary will update on new commits.}