test(server): align L3 smoke with console contract

[StringKe]

Summary

• update password, password-reset, enterprise OIDC, and enterprise SAML browser smoke waits to use the authenticated Console contract
• expose the contract state in L3 snapshots for explicit post-navigation assertions
• keep /v1/me email, instance manager, active organization, cookie, and protocol assertions unchanged

Root cause

The L3 harness still waited for Sign out or the admin email in visible page text. The Console redesign intentionally moved both into the closed Account dropdown. Authentication and routing completed, but the presentation-dependent checks timed out.

Validation

• PASS node --check apps/server/tests/smoke/harness/smoke-l3-password-browser.mjs
• PASS node --check apps/server/tests/smoke/harness/smoke-l3-password-reset-browser.mjs
• PASS pnpm --filter @xid-kit/server check (711 formatted, 705 linted, warning budget 0)
• PASS pnpm run security:secret-scan
• PASS git diff --check
• PASS static search confirms no remaining Console authentication waits on visible Sign out or admin email text
• SKIP local browser run by explicit request; authoritative main CI runs the full L2/L3 chain after merge