Add the end-to-end rights matrix as a runnable gate: bun run test:e2e-rights

Three fresh users plus an anonymous reader, on the live local stack: login, consent and app install are driven through the UI and asserted at setup; reads, refused writes, profile privacy, discovery, opening a foreign event, join and leave with their counts, isolation of each user's own pod, and catalog listing are each a named line with expected and actual, printed as a report. The exit code is non-zero iff a hard line fails. Known platform behaviours (attendee lists world-readable, an anonymous PATCH accepted on attendees collections) are tracked as non-fatal lines that flag a change; paths that need a crafted request are recorded as manual checks.

package.json

@@ -12,6 +12,7 @@
     "test:auth-setup": "bun scripts/setup-test-auth.ts",
     "test:e2e-flow": "bun scripts/e2e-login-flow.ts",
     "test:e2e-revocation": "bun scripts/e2e-revocation.ts",
+    "test:e2e-rights": "bun scripts/e2e-rights-matrix.ts",
     "cucumber:report": "bun scripts/parse-test-results.ts",
     "features:parse": "bun scripts/parse-features.ts",
     "steps:extract": "bun scripts/extract-step-definitions.ts",