Add authenticated E2E smoke tests with seeded student tutor and admin users

[Taleef7]

Context

The March E2E context file shows authenticated browser testing was started but not completed. Current automated coverage is useful, but the launch-critical flows are role-based and need seeded user coverage.

Acceptance criteria

• Add a documented seeded-user setup for student/parent, tutor, and admin roles in local Supabase or test fixtures.
• Cover at least one student request/payment flow, one admin payment/matching/session generation flow, and one tutor session update flow.
• Include route-protection checks for wrong-role access.
• Keep tests deterministic and safe to run locally/CI without production secrets.
• Link failures to separate implementation issues rather than hiding them in the test work.

References

• .tmp/sessions/2026-03-29-corved-e2e/context.md
• docs/MVP.md launch checklist
• docs/plan-CorvEd.md integration smoke test item