Skip the Login (Storage State)

The session is held in an httpOnly cookie, so the client cannot read it directly — it must ask the server via GET /api/lab/login?action=me. The real skill here is saving that authenticated state and reusing it, not retyping credentials in every spec.

Logins so far: … — the endpoint throttles at 5 logins per minute (429), so a naive per-test login will stall the whole suite.