[AZ-457] [AZ-459] [AZ-465] [AZ-481] Batch 2 - auth/enum/i18n/CI tests

Implements 22 blackbox test scenarios across the four batch-2 tasks:

AZ-457 - Auth & token handling (11 scenarios, fast + e2e):
- src/api/client.test.ts: FT-P-02, NFT-SEC-04, NFT-PERF-02, NFT-RES-01,
  NFT-RES-08 (apiClient surface)
- src/auth/AuthContext.test.tsx: FT-P-01 (it.fails - Step 4 drift),
  FT-P-03, NFT-SEC-01, NFT-SEC-02
- src/auth/ProtectedRoute.test.tsx: FT-N-04, NFT-RES-08 (router half)
- e2e/tests/auth.e2e.ts: FT-P-02 e2e, NFT-SEC-01/02/03 (cookie attrs
  via Playwright context.cookies(), gated by suite stack)

AZ-459 - Wire-contract enums (4 scenarios):
- tests/wire_contract.test.ts: FT-P-04 (AnnotationStatus, it.fails),
  FT-P-05 (MediaStatus + Affiliation it.fails; CombatReadiness skip
  per verification_pending), FT-P-06 (AnnotationSource control +
  spec value-set membership), FT-N-15 (typed-enum shape + skip for
  value-set verification)
- e2e/tests/wire_contract.e2e.ts: FT-P-06 against real annotations/
  service, drift-gated via AZAION_RUN_DRIFT_E2E
- scripts/run-tests.sh STC-FN15: ripgrep static for MediaType
  magic-literal hygiene

AZ-465 - i18n (4 scenarios, all static + quarantined fast):
- scripts/check-i18n-coverage.mjs: FT-P-22 (en vs ua key parity) +
  FT-P-23 (no raw user strings outside t() in src/**/*.tsx); refined
  JSX text-node regex with negative lookbehind to drop TS generics
  + arrow-function false positives
- tests/i18n-allowlist.json: snapshot of current pre-existing raw
  strings (CI gates growth per AZ-465 Constraints)
- tests/i18n.test.tsx: FT-P-24 + FT-P-25 it.skip (QUARANTINE - i18n
  detector + persistence not wired today; control tests assert the
  gap so the skip flips to a real test once Step 4 lands)

AZ-481 - CI image labels (3 scenarios, static against
  .woodpecker/build-arm.yml):
- scripts/check-ci-image-labels.mjs: NFT-RES-LIM-11 (tag scheme
  ${CI_COMMIT_BRANCH}-arm), NFT-RES-LIM-12 (revision/created/source
  PASS, image.title reported as DRIFT - foundation/CI-CD owns the
  fix), NFT-RES-LIM-13 (revision = $CI_COMMIT_SHA)

Cross-cutting:
- scripts/run-tests.sh: src_grep now excludes *.test.{ts,tsx} +
  *.spec.{ts,tsx} so production-source static checks (STC-SEC4,
  STC-FN15, etc.) don't false-positive on test prose
- tsconfig.json: exclude src/**/*.{test,spec}.{ts,tsx} so production
  tsc -b doesn't see jest-dom matchers
- _docs/03_implementation/batch_02_report.md: full per-task AC
  coverage matrix + drift inventory + verification run
- _docs/_autodev_state.md: 22 tasks remain after batch 2

Verification (host):
  fast    : 7 files, 38 passed | 4 skipped (quarantined)
  static  : 19/19 checks PASS (was 13 in batch 1; +6 from batch 2)
  e2e     : not run on host (Risk 4 - requires suite docker stack)

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/i18n.test.tsx

@@ -0,0 +1,67 @@
+import { describe, expect, it } from 'vitest'
+import i18n from '../src/i18n/i18n'
+
+// AZ-465 — i18n detector + persistence (fast counterparts).
+//
+//   FT-P-24 (row 47) — i18n detector path used at first boot
+//                      Profile: fast — `quarantined` per blackbox-tests.md
+//                      until the navigator.language detector is added in
+//                      Step 4. Today src/i18n/i18n.ts hardcodes `lng: 'en'`
+//                      so the test would assert the detector branch ran when
+//                      no detector exists.
+//   FT-P-25 (row 48) — i18n persistence across reload
+//                      Profile: e2e — `quarantined` per spec until detector
+//                      + persistence land. Fast counterpart asserts the
+//                      i18n instance carries no persisted-language detector
+//                      so persistence can't have shipped yet.
+//
+// Both tests write the QUARANTINE marker (Vitest's `.skip` reporter line +
+// inline reason). When the detector + persistence feature lands, the marker
+// flips: removing `.skip` reveals the assertion, which then drives the
+// production feature green.
+//
+// Black-box discipline: import `i18n` (the `00_foundation` public API) only;
+// no React-component internals.
+
+describe('AZ-465 / src/i18n/i18n.ts — detector + persistence (quarantined)', () => {
+  describe('FT-P-24 (row 47) — detector path on first boot', () => {
+    it.skip('first boot reads navigator.language; no hardcoded `lng: "en"` (QUARANTINE: detector pending Step 4)', () => {
+      // Arrange — when the feature lands the test should:
+      //   1. Mount the SPA in jsdom with `Object.defineProperty(navigator, 'language', { value: 'uk' })`.
+      //   2. Reload the i18n instance.
+      //   3. Assert i18n.language === 'uk' or starts with 'uk'.
+      //   4. Assert that src/i18n/i18n.ts source no longer contains `lng: 'en'`
+      //      (covered by a static check FT-P-24 partial).
+      //
+      // Today the production code initialises with `lng: 'en'` so the
+      // detector branch never fires. Skipping per spec.
+      expect(true).toBe(false)
+    })
+
+    it('control: today the i18n instance defaults to en (drives the QUARANTINE flip)', () => {
+      // Arrange + Assert
+      expect(i18n.language).toBe('en')
+    })
+  })
+
+  describe('FT-P-25 (row 48) — persistence across reload', () => {
+    it.skip('toggle to uk, reload, language persists (QUARANTINE: persistence pending Step 4)', () => {
+      // Arrange — when the feature lands the test should:
+      //   1. Switch language to uk via i18n.changeLanguage('uk').
+      //   2. Persist (i18next-browser-languagedetector with localStorage).
+      //   3. Re-create the i18n instance and assert .language === 'uk'.
+      //
+      // Today no language-detector or storage adapter is configured.
+      expect(true).toBe(false)
+    })
+
+    it('control: i18n config has no persistence adapter today', () => {
+      // Arrange + Assert — i18next options exposes the language detector
+      // chain via `services.languageDetector`. With no detector configured,
+      // services.languageDetector is undefined — confirming persistence
+      // hasn't shipped yet.
+      const detector = (i18n as unknown as { services: { languageDetector?: unknown } }).services.languageDetector
+      expect(detector).toBeUndefined()
+    })
+  })
+})