fix(ci): integration tests + e2e workflows green again

Two unrelated root-causes were keeping the Integration tests and e2e
workflows red on every push to main since `d8c549e` (50+ runs).

1. Integration: `.github/workflows/integration.yml` had `ENCRYPTION_KEY:
   0000…` as a bare YAML scalar. YAML 1.2 parses a run of zeros as the
   integer 0 — so the runner exported `ENCRYPTION_KEY=0`, and
   `decodeKey()` rejected it as "must be hex (>= 32 chars) or base64
   (32 bytes)". 6 tests in admin-backups-* and integration-status
   failed at module load. Quoting the value forces a literal string.

2. e2e: the global-setup seeded user had `onboarding_tour_completed`
   left at its default `false`, so the spotlight tour mounted a
   full-viewport `role="dialog"` overlay (z-index 200) on every
   authenticated spec. Playwright's hit-test then caught the tour's
   skip-button instead of the intended target — every spec that
   clicked sidebar / quick-add / logo timed out. Setting the column
   to `true` in the upsert keeps the tour off the dashboard for the
   rest of the suite. The two `onboarding-flicker.spec.ts` mocks
   that fulfil `/api/auth/me` from inside the spec also need the
   field, since they replace the seeded payload.

Workflow change is comment + quoted strings only — no secrets, no
runtime cost.

.github/workflows/integration.yml

@@ -29,6 +29,12 @@ jobs:
           # The integration suite boots a Postgres testcontainer and points
           # Prisma at it via DATABASE_URL set inside `tests/integration/setup.ts`.
           # These env vars satisfy code paths that read them at module load.
-          API_TOKEN_HMAC_KEY: integration-tests-do-not-use-in-prod
-          ENCRYPTION_KEY: 0000000000000000000000000000000000000000000000000000000000000000
-          SESSION_SECRET: integration-tests
+          #
+          # ENCRYPTION_KEY MUST be quoted: YAML 1.2 parses an unquoted run of
+          # zeros as the integer 0, which then arrives in `process.env` as the
+          # string "0" — failing crypto's hex/base64 length check and breaking
+          # the backups + integration-status suites for 50+ runs (regression
+          # since v1.4.13). Quoting forces a literal scalar.
+          API_TOKEN_HMAC_KEY: "integration-tests-do-not-use-in-prod"
+          ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
+          SESSION_SECRET: "integration-tests"