[BE-127] Build a real E2E suite — the CI job currently passes with no tests

[mftee]

Overview

CI has a well-configured backend-e2e job with Postgres 16 and Redis 7 service containers, correct environment variables, and PR-only triggering — genuinely good infrastructure. But it runs npm run test:e2e -- --passWithNoTests against a single placeholder spec, so all of that runs and proves nothing.

Tasks

• Write E2E specs covering the critical journeys: register → login → upload document → risk assessment → verification → retrieve.
• Cover authorization end to end: a user cannot read another user's documents, disputes, or access logs.
• Cover the public verification path without authentication.
• Truncate tables between tests for isolation.
• Remove --passWithNoTests once specs exist.
• Once [BE-111] lands, ensure the E2E job provisions schema via real migrations so migration correctness is validated on every PR.

Acceptance Criteria

• npm run test:e2e exercises real journeys against the service containers.
• Cross-user authorization tests fail if a guard is removed.
• The job no longer passes vacuously.

Dependencies

Best after [BE-111].

Notes for Contributors

Comment below to be assigned.