Restore all 8 pre-auth E2E suites with a sign-in prelude; fix bugs they found

New e2e-auth-helper.cjs: shared signInFreshFamily() prelude — signs in as
the confirmed test owner account and creates a uniquely-named family per
run, so accumulated data from a previous run's assets/hibah/etc. (now
persisted in Supabase, not wiped with the browser context like localStorage
was) can never bleed into another run's percentage/coverage assertions.
All 8 suites (e2e-uat, e2e-fastpath, e2e-trust, e2e-business,
e2e-digital-vehicle, e2e-property, e2e-other, e2e-info) now call it in
place of the old anonymous page.goto(BASE).

Restoring them surfaced two real product bugs, not just test staleness:

1. WassiyahGenerator.svelte was never migrated to Supabase in the earlier
   backend work — it still called the old local storage.js load()/save()
   for assets, bequests, and witnesses, so the one-third meter silently
   read an empty local cache and always showed 0. Migrated to family-scoped
   Supabase tables (new nf_wassiyah_bequests, nf_wassiyah_settings, with
   member-scoped RLS) matching the pattern used for Hibah/Nominations/etc.

2. storage.js's exportAll() did an unguarded JSON.parse on every
   "nf."-prefixed localStorage key, but family.js stores activeFamilyId as
   a raw string (not JSON-encoded) — one malformed parse threw and silently
   aborted the whole export before the file download fired. Made exportAll
   defensive: falls back to the raw string on a parse failure instead of
   throwing.

The remaining test failures were async-timing gaps inherent to the move
from synchronous localStorage reads to async Supabase fetches: several
assertions checked <select> option counts or newly-created rows immediately
after a fixed short wait, before the async load/refresh had actually
landed. Fixed by replacing blind isVisible()/fixed-timeout checks with
proper waitFor()/polling in the test helpers (selectByText, corpus-select
population, row-creation checks) — not a product bug, but worth fixing
since the old timing assumptions no longer hold now that data is live and
shared instead of instant and local.

Results: e2e-uat 32/32, e2e-fastpath 16/16, e2e-trust 12/12,
e2e-business 10/10, e2e-digital-vehicle 10/10, e2e-property 9/9,
e2e-other 4/4, e2e-info 31/31 — 124/124. Re-verified e2e-family-agent
(12/12) and e2e-smoke-authed (24/24) still pass after the
WassiyahGenerator migration. 160/160 total across all ten suites.

e2e-auth-helper.cjs

@@ -0,0 +1,25 @@
+// Shared sign-in prelude for the pre-auth-gate E2E suites. Each suite creates
+// its own fresh family per run (unique name) so accumulated data from a
+// previous run's assets/hibah/etc. can never bleed into another run's
+// percentage/coverage assertions — same isolation the old per-context
+// localStorage gave for free, now done explicitly since data is shared and
+// persistent in Supabase instead of wiped with the browser context.
+const OWNER_EMAIL = 'nurfalah.e2etest.owner@gmail.com';
+const OWNER_PASSWORD = 'TestPassword123!';
+
+async function signInFreshFamily(page, BASE, familyLabel) {
+  await page.goto(BASE, { waitUntil: 'networkidle' });
+  await page.locator('.field:has-text("Email") input').fill(OWNER_EMAIL);
+  await page.locator('.field:has-text("Password") input').fill(OWNER_PASSWORD);
+  await page.locator('button.btn-primary', { hasText: 'Sign in' }).click();
+  await page.waitForTimeout(1500);
+
+  const familyName = `${familyLabel || 'E2E'} ${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
+  await page.locator('.field:has-text("Family name") input').fill(familyName);
+  await page.locator('button.btn-primary', { hasText: 'Create family' }).click();
+  await page.waitForTimeout(1200);
+
+  return familyName;
+}
+
+module.exports = { signInFreshFamily, OWNER_EMAIL, OWNER_PASSWORD };