E2E for token timeout + refresh (todo §4); full-stack auth-refresh.spec.ts (real Ory stack): a lapsed session JWT is silently re-minted from the live Kratos session (roles re-read from Keto), and cleared once the session is revoked; ory/kratos/e2e.yml shortens the tokenizer ttl to 8s + adds JWT_CLOCK_SKEW_SEC config so re-mint fires at expiry; scope visual suite to visual.spec.ts

compose.e2e.yml

@@ -24,6 +24,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.e2e
+    # Just the Ory-free visual suite; the full-stack auth spec runs via compose.e2e-auth.yml.
+    command: ["npx", "playwright", "test", "visual.spec.ts"]
     depends_on:
       web:
         condition: service_healthy