D3: Add two-user isolation, guest import, session, playback, and privacy E2E suites

[hieunguyenminhhnl]

Parent epic: #9

Priority: P0
Workstream: D

Scope

Implement P0 GST/ISO/IMP/SES/PB/PRV matrix across every protected resource, import races/conflicts, revoke/expiry/account switch, playback continuity, export/history/deletion/purge.

Acceptance criteria

• No cross-user read/mutation/cache leak; imports are idempotent; identity transitions preserve playback; privacy/deletion invariants pass with retries 0.
• Relevant npm run lint, npx tsc --noEmit, focused tests, and production build checks pass.

Dependencies

B3–B7, C1–C5, D1.

References

• PRD.md
• docs/auth-foundation-plan.md
• docs/auth-ux-plan.md
• docs/auth-quality-security-plan.md