feat: add scenario-based Screen Lab

[winetree94]

What changed

• add a single browser-safe ScreenScenario catalog shared by manual inspection and Playwright visual tests
• render route-only states through a development-only fixture host and use isolated SQLite E2E servers for session, OIDC, TOTP, passkey, and admin states
• add pnpm screen:dev --scenario <id> with variant selection, deterministic setup, and reverse-order cleanup
• add 26 Windows/Chromium visual baselines across 12 scenarios and selected locale, theme, and mobile variants
• run Screen Lab visual coverage in two Windows CI shards and merge the blob reports into an HTML artifact

Why

Reaching deeply nested authentication screens required repeatedly creating accounts and manually completing email, OAuth, and second-factor setup. Named deterministic scenarios make those states immediately reproducible while preserving real server-backed coverage where authentication state matters.

Developer impact

Use pnpm screen:dev --list to discover scenarios, then open one with pnpm screen:dev --scenario login or select a variant such as pnpm screen:dev --scenario login --variant ko-light.

Validation

• pnpm install --frozen-lockfile
• pnpm build
• pnpm biome check .
• focused Screen Lab unit/contract tests: 16 passed
• pnpm --filter @tinyrack/tinyauth-frontend test:e2e:screen: 26 passed
• pnpm test: passed
• pnpm screen:dev --list