Review fixes: plain depends_on merge, positive secret assertion

e2e-tests/compose.full.yml

@@ -1,25 +1,16 @@
-# Full browser E2E — the real Playwright UI flow against the live stack: password +
-# mocked-SSO login, menu filtering by role, users/groups/roles/OAuth2-clients CRUD, a plugin page,
-# logout. A tiny
-# same-origin gateway (proxy, e2e-tests/proxy.ts) fronts web + Kratos on one host so the browser's cookies
+# Full browser E2E — the real Playwright UI flow against the live stack: password + mocked-SSO
+# login, menu filtering by role, users/groups/roles/OAuth2-clients CRUD, a plugin page, logout. A
+# tiny same-origin gateway (proxy, e2e-tests/proxy.ts) fronts web + Kratos on one host so the browser's cookies
 # round-trip (ory/kratos/e2e-proxy.yml points Kratos at it); a mock OIDC provider backs the SSO test.
 #   docker compose -f compose.yml -f e2e-tests/compose.full.yml run --build --rm e2e
 #   docker compose -f compose.yml -f e2e-tests/compose.full.yml down -v   # tear down after
 services:
   web:
-    # Kratos + Keto + bootstrap back the login/role flows; Hydra backs the admin plugin's
-    # OAuth2-clients screen. SSO is enabled here only (clean clone stays password-only): the mock
-    # provider's whole array is the env-settable form Kratos offers, mapped through the committed
-    # claims jsonnet.
-    depends_on: !override
-      bootstrap:
-        condition: service_completed_successfully
-      hydra:
-        condition: service_healthy
-      kratos:
-        condition: service_healthy
-      keto:
-        condition: service_healthy
+    # The base's full depends_on applies (Hydra included — the admin plugin's OAuth2-clients
+    # screen needs it); only the reference plugin's upstream is added. SSO is enabled here only
+    # (clean clone stays password-only): the mock provider's whole array is the env-settable form
+    # Kratos offers, mapped through the committed claims jsonnet.
+    depends_on:
       shifts-upstream:
         condition: service_healthy
     environment: