test(e2e): cover doctor-report generation end to end

The doctor report had unit coverage for the renderer and route coverage for
the envelope, and nothing that pressed the button. Two browser journeys close
that.

`doctor-report.spec.ts` seeds a few weeks of blood pressure and weight, one
allergy and one medication through the page's own `fetch`, picks a window in
the export panel and generates. The saved download is asserted as a real
artefact — `%PDF` magic, a `Content-Length` that agrees with the bytes, a
length no empty document reaches — and then parsed back to text, so the
period line, the blood-pressure section and the drug list are read out of the
document rather than inferred from a 200. The period is checked as a span, so
the assertion survives the account's timezone. Its refusing control is a
window with no readings: still a valid, readable report that names the period
and carries no blood-pressure section, with the reference data that is not
window-scoped as the control against a blank page passing.

`doctor-report-delegate.spec.ts` covers the access boundary the route draws at
MANAGE. A delegate inside a record it may only read is not offered the export
card at all, and the route refuses the request that card would have sent with
`sharing.access.denied`. The positive control is the same delegate, the same
payload and the same switched-record path against a record it manages, so the
one variable between pass and refusal is the access level. Both requests carry
the record-context headers the shipped client sends: without them the fence
refuses with the same status and the same error code, which would make the
refusal pass for the wrong reason.

Seeding is idempotent — a re-posted reading collides on its natural key and
answers 409 — so a second local run and a repeated run both stay green. The
delegate journey takes its own cookie jar because it moves the session's
record selector, and both specs run in one project.

e2e/setup/global-setup.ts

@@ -250,6 +250,17 @@ export const CROSS_TAB_STORAGE_STATE_PATH = resolve(
   "e2e/setup/storageStateCrossTab.json",
 );
 
+/**
+ * The doctor-report delegate journey's jar. Its own session row, for the reason
+ * every switching spec has one: it opens somebody else's record to prove the
+ * report refuses a READ-level grant, and two specs driving one row from two
+ * workers would test their interference rather than the refusal.
+ */
+export const REPORT_DELEGATE_STORAGE_STATE_PATH = resolve(
+  process.cwd(),
+  "e2e/setup/storageStateReportDelegate.json",
+);
+
 /**
  * The banner-geometry spec's jar, and the reason it exists is a release-shaped
  * one rather than a load-shaped one.
@@ -760,6 +771,7 @@ export default async function globalSetup(config: FullConfig): Promise<void> {
     await capture(E2E_SCOPE_DELEGATE, FENCE_OFFLINE_STORAGE_STATE_PATH);
     await capture(E2E_SCOPE_DELEGATE, CROSS_TAB_STORAGE_STATE_PATH);
     await capture(E2E_SCOPE_DELEGATE, SEAM_BANNERS_STORAGE_STATE_PATH);
+    await capture(E2E_SCOPE_DELEGATE, REPORT_DELEGATE_STORAGE_STATE_PATH);
 
     // v1.37.0 — the guardian's jar, and only then its second factor.
     //

e2e/setup/test-helpers.ts

@@ -25,5 +25,6 @@ export {
   FENCE_STORAGE_STATE_PATH,
   FENCE_OFFLINE_STORAGE_STATE_PATH,
   CROSS_TAB_STORAGE_STATE_PATH,
+  REPORT_DELEGATE_STORAGE_STATE_PATH,
   GUARDIAN_STORAGE_STATE_PATH,
 } from "./global-setup";