test(e2e): §22-current Tier-1 harness + metadata E2E (SLICE-3/4/5)

Modernize the Tier-1 stack to the three-tier app and add browser coverage for
the §22.4a metadata UI, closing the E2E gap deferred across SLICE-3/4/5:
- seed-gitea.sh: create a REGISTRY_REPO with projects.yaml + a faceted named
  collection (.collection.yaml fields: priority enum + tags) seeded with three
  metadata-bearing entries; register content+registry webhooks; self-guarding
  (skip if a prior token still works) so a dependency-triggered re-run can't
  remint and invalidate the backend's token.
- .env.tier1: REGISTRY_REPO/DEFAULT_PROJECT_ID; disable OTC cooldown + lift the
  per-IP auth limiter for the single-IP test runner.
- docker-compose: pin backend image; backend-seed inserts a granted owner the
  OTC path can sign in as (write paths need contributor+).
- Makefile: two-phase tier1-up (seed to completion, then create backend so it
  reads the populated token env); robust down; e2e-fresh = down+up+e2e (the
  canonical run, since the edit/bulk specs mutate the seeded corpus).
- metadata.spec.js: SLICE-3 faceted filter (anon), SLICE-4 edit panel (owner),
  SLICE-5 bulk bar (owner). 4 passed against a fresh stack.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

testing/.env.tier1

@@ -3,7 +3,8 @@ GITEA_BOT_USER=rfc-bot
 GITEA_BOT_TOKEN=tier1-bot-token-PLACEHOLDER
 GITEA_ORG=wiggleverse
 META_REPO=ohm-content
-REGISTRY_REPO=
+REGISTRY_REPO=rfc-registry
+DEFAULT_PROJECT_ID=ohm
 OAUTH_CLIENT_ID=tier1-oauth-client-PLACEHOLDER
 OAUTH_CLIENT_SECRET=tier1-oauth-secret-PLACEHOLDER
 APP_URL=http://localhost:8080
@@ -19,3 +20,11 @@ EMAIL_FROM=rfc@example.test
 EMAIL_FROM_NAME=RFC Tier1
 EMAIL_ENABLED=true
 TURNSTILE_REQUIRED=false
+# Tier-1/e2e: disable the per-email OTC request cooldown so a test can sign the
+# same account in more than once across specs without 429s.
+OTC_REQUEST_COOLDOWN_SECONDS=0
+# Tier-1/e2e drives the auth endpoints repeatedly from one IP; lift the per-IP
+# sliding-window budgets well above a single suite run (prod leaves these unset
+# and keeps the secure defaults).
+RATELIMIT_OTC_REQUEST_MAX=1000
+RATELIMIT_VERIFY_MAX=1000