Clear the e2e password gate before seeding commands

Why: a freshly created account still has must_change_password set, so the seed command returns 403 before Playwright can open the audit workspace.
Evidence: a replay of the isolated seed received "forbidden: password setup required" on rdm.project.create.
Impact: the seed completes the existing set-password call and logs in again. Browser login still starts from the initial password.
Refs: scripts/e2e.sh
Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/e2e.sh

@@ -16,6 +16,7 @@
 #   RDM_REPO            RDM 仓路径（默认 <本仓上级>/Agent-System-RDM）
 #   E2E_API_PORT/E2E_UI_PORT   服务端口（默认 18791/4173）
 #   E2E_OWNER/E2E_PASSWORD     登录账号（默认 e2e-auditor/E2eAudit#2026）
+#   E2E_PASSWORD2              首次登录后的设密结果（默认 E2eAudit#2026b；种子命令用它）
 #   E2E_PROJECT_MAIN/E2E_PROJECT_ISOLATED  项目名（默认 审计演示项目/隔离检查项目）
 #   E2E_OUT             工件目录（默认 .tmp/e2e/<ts>；.gitignore 已覆盖 .tmp）
 # 依赖：go、node/npm、curl；首次运行会 npx playwright install chromium。
@@ -32,6 +33,7 @@ API_PORT=${E2E_API_PORT:-18791}
 UI_PORT=${E2E_UI_PORT:-4173}
 OWNER=${E2E_OWNER:-e2e-auditor}
 PASSWORD=${E2E_PASSWORD:-E2eAudit#2026}
+PASSWORD2=${E2E_PASSWORD2:-E2eAudit#2026b}
 PROJ_MAIN=${E2E_PROJECT_MAIN:-审计演示项目}
 PROJ_ISO=${E2E_PROJECT_ISOLATED:-隔离检查项目}
 API_BASE="http://127.0.0.1:$API_PORT"
@@ -126,6 +128,15 @@ login() {
     -H 'Content-Type: application/json' \
     -d "{\"owner\":\"$OWNER\",\"password\":\"$PASSWORD\"}" >/dev/null || die "login failed"
 }
+# CLI 建号留下 must_change_password。会话在改密前不能调用业务命令。
+# 强制设密会作废当前会话，所以设密后用新密码再登录。
+finish_password_gate() {
+  curl -sf -b "$JAR" -c "$JAR" -X POST "$API_BASE/api/auth/password" \
+    -H 'Content-Type: application/json' \
+    -d "{\"next\":\"$PASSWORD2\"}" >/dev/null || die "password setup failed"
+  PASSWORD=$PASSWORD2
+  login
+}
 
 cmd() { # cmd <id> <params-json> → payload（失败即死，种子步骤不容忍部分成功）
   local id=$1 params=${2:-{\}}
@@ -139,6 +150,7 @@ cmd() { # cmd <id> <params-json> → payload（失败即死，种子步骤不容
 start_serve
 JAR="$OUT/cookies.txt"
 login
+finish_password_gate
 log "seed: create projects"
 PID_MAIN=$(cmd rdm.project.create "{\"name\":\"$PROJ_MAIN\"}" | python3 -c 'import json,sys; print(json.load(sys.stdin)["projectId"])')
 PID_ISO=$(cmd rdm.project.create "{\"name\":\"$PROJ_ISO\"}" | python3 -c 'import json,sys; print(json.load(sys.stdin)["projectId"])')
@@ -212,7 +224,8 @@ log "playwright (install chromium if missing)"
 
 log "run specs"
 cd "$DEV_ROOT/modules/frontend"
-export PLAYWRIGHT_BASE_URL="http://127.0.0.1:$UI_PORT" E2E_OWNER="$OWNER" E2E_PASSWORD="$PASSWORD" \
+export PLAYWRIGHT_BASE_URL="http://127.0.0.1:$UI_PORT" E2E_OWNER="$OWNER" \
+  E2E_PASSWORD="${E2E_PASSWORD:-E2eAudit#2026}" E2E_PASSWORD2="$PASSWORD2" \
   E2E_PROJECT_MAIN="$PROJ_MAIN" E2E_PROJECT_ISOLATED="$PROJ_ISO"
 set +e
 npx playwright test --reporter=list >"$OUT/playwright.log" 2>&1