e2e: harden akLogin against Lit stage re-render; settle per hop in crawl/sso

tests/e2e/specs/13-sso.spec.ts

@@ -1,21 +1,30 @@
 import { expect, test } from "@playwright/test";
 
-// Single-login enforcement: with ONLY the homepage session cookies, a direct
-// visit to every outpost-guarded vhost must resolve through Anubis +
-// authentik silently and land on the app — no login form, no challenge, no
-// IdP error page. Exercises the provider the outpost actually carries
-// (fixed 2026-09-01: loki/grafana/seerr were missing from the outpost M2M).
+// With ONLY the homepage session cookies, a direct visit to every
+// outpost-guarded vhost must resolve through Anubis + authentik silently and
+// land on the app - no login form, no challenge, no IdP error page.
+// Single-login enforcement (SSO across hosts). Loki serves no web UI beyond
+// its API surface, so a sub-500 answer is its pass condition.
 
-const GUARDED = ["search", "romm", "files", "seerr", "grafana", "prometheus", "loki"];
+const GUARDED = ["search", "romm", "files", "seerr", "grafana", "prometheus", "loki"].map(
+  (sub) => `https://${sub}.franksdank.cloud/`,
+);
 
-for (const host of GUARDED) {
-  test(`SSO passes silently for ${host}.franksdank.cloud`, async ({ page }) => {
-    await page.goto(`https://${host}.franksdank.cloud/`);
+for (const vhost of GUARDED) {
+  test(`SSO passes silently for ${new URL(vhost).hostname}`, async ({ page }) => {
+    test.setTimeout(180_000);
+    await page.goto(vhost);
+    await expect
+      .poll(
+        async () => !(await page.locator("body").innerText()).includes("Making sure you're not a bot"),
+        { timeout: 90_000 },
+      )
+      .toBe(true);
     await expect
       .poll(() => new URL(page.url()).hostname, { timeout: 60_000 })
-      .toBe(`${host}.franksdank.cloud`);
-    expect(await page.locator('input[name="uidField"]').count()).toBe(0);
+      .toBe(new URL(vhost).hostname);
     const body = await page.locator("body").innerText();
+    expect(body).not.toContain("Sign in"); // authentik identification stage
     expect(body).not.toContain("Making sure you're not a bot");
     const resp = await page.request.get(page.url());
     expect(resp.status()).toBeLessThan(500);