test(e2e): §22-current Tier-1 harness + metadata E2E (SLICE-3/4/5)

Modernize the Tier-1 stack to the three-tier app and add browser coverage for
the §22.4a metadata UI, closing the E2E gap deferred across SLICE-3/4/5:
- seed-gitea.sh: create a REGISTRY_REPO with projects.yaml + a faceted named
  collection (.collection.yaml fields: priority enum + tags) seeded with three
  metadata-bearing entries; register content+registry webhooks; self-guarding
  (skip if a prior token still works) so a dependency-triggered re-run can't
  remint and invalidate the backend's token.
- .env.tier1: REGISTRY_REPO/DEFAULT_PROJECT_ID; disable OTC cooldown + lift the
  per-IP auth limiter for the single-IP test runner.
- docker-compose: pin backend image; backend-seed inserts a granted owner the
  OTC path can sign in as (write paths need contributor+).
- Makefile: two-phase tier1-up (seed to completion, then create backend so it
  reads the populated token env); robust down; e2e-fresh = down+up+e2e (the
  canonical run, since the edit/bulk specs mutate the seeded corpus).
- metadata.spec.js: SLICE-3 faceted filter (anon), SLICE-4 edit panel (owner),
  SLICE-5 bulk bar (owner). 4 passed against a fresh stack.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

testing/docker-compose.yml

@@ -57,6 +57,7 @@ services:
     restart: "no"
 
   backend:
+    image: rfc-tier1-backend
     build:
       context: ..
       dockerfile: testing/backend.Dockerfile
@@ -74,6 +75,30 @@ services:
       timeout: 3s
       retries: 30
 
+  # Insert a granted deployment-owner user keyed by a known e2e email, so the
+  # OTC sign-in path (which provisions only `pending` contributors) yields an
+  # owner who can exercise the metadata edit/bulk write paths (SLICE-4/5). The
+  # owner identity (gitea_login='owner') matches OWNER_GITEA_LOGIN. Idempotent.
+  backend-seed:
+    image: rfc-tier1-backend
+    depends_on:
+      backend:
+        condition: service_healthy
+    volumes:
+      - backend-data:/data
+    entrypoint: ["python", "-c"]
+    command:
+      - |
+        import sqlite3
+        c = sqlite3.connect("/data/rfc-app.db")
+        c.execute("""INSERT INTO users
+            (gitea_id, gitea_login, email, display_name, avatar_url, role, permission_state)
+            SELECT 9001, 'owner', 'e2e-owner@example.test', 'E2E Owner', '', 'owner', 'granted'
+            WHERE NOT EXISTS (SELECT 1 FROM users WHERE email='e2e-owner@example.test' COLLATE NOCASE)""")
+        c.commit(); c.close()
+        print("backend-seed: owner user ready")
+    restart: "no"
+
   web:
     build:
       context: ..