feat(DPoP): UI: bcast events to support multi tab

add also playwright test with the multi tab

tests/e2e/playwright.config.ts

@@ -66,13 +66,14 @@ export default defineConfig({
       // Verbose startup so a CI webServer-readiness timeout shows where the
       // server stalls (DB connect, migrations, bind) instead of nothing.
       RUST_LOG: 'info,oxicloud=debug,sqlx=warn,tower_http=info',
-      // OPAQUE substrate is off for the E2E suite — Hurl exercises it via
-      // `tests/common/server.env`; the SPA-facing coverage suite doesn't
-      // need the boot-time init nor the ~200 KiB WASM client. Blanking
-      // the inherited commonEnv values takes the DI factory's
-      // `effective_mode == Off` short-circuit.
-      OXICLOUD_AUTH_OPAQUE_MODE: 'off',
-      OXICLOUD_AUTH_OPAQUE_SERVER_SETUP: '',
+      // OPAQUE + DPoP are inherited from `../common/server.env`:
+      //   OXICLOUD_AUTH_OPAQUE_MODE=migrate  (Phase 2 silent-migration
+      //     on first legacy login, Phase 4 refusal thereafter)
+      //   OXICLOUD_DPOP_MODE=required        (verify every proof; unbound
+      //     sessions still exempt per Gate 5 design)
+      // Testing under the production shape catches breakage where the
+      // SPA's fetch interceptor or the migration hook regresses in
+      // ways that only surface in a real browser + real crypto.
     },
   },
 });