test(e2e): address self-review follow-ups (dedup, XSS render guard, SSE hardening)

Follow-ups from the code review of the test-quality batches:

- Consolidate duplicated helpers into e2e/helpers/: seed.ts (seedUpload,
  seedComment, listComments, findFeedRow) and sse.ts (mintSseTicket, openStream,
  trackStreamOpens). Refactor authorization-deep, xss-injection, like-comment,
  sse-ticket-abuse, ddos, sse-realtime, multi-tab, and SseListener to use them —
  the upload/comment/ticket-flow contracts now live in one place each instead of
  being re-inlined across 3–7 specs.
- xss-injection display-name loop: it navigated to /feed (which renders uploader
  names, not the viewer's) so "nothing fired" passed vacuously — the payload was
  never rendered. Now navigate to /account (the actual sink) and add a render
  guard asserting the payload reached the DOM as escaped text before checking
  __xssFired.
- sse-realtime reconnect: snapshot the stream-open count AFTER backgrounding, so
  the "new connection" assertion is attributable to the foreground event and can't
  be satisfied by a spurious native/error reconnect before the toggle.
- recover-page: correct the comment (auto-submit is the onPinInput handler, not an
  $effect).

44 affected specs verified green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/08-browser-chaos/multi-tab.spec.ts

@@ -3,28 +3,21 @@
  * browser process.
  */
 import { test, expect } from '../../fixtures/test';
+import { trackStreamOpens } from '../../helpers/sse';
 
 test.describe('Browser chaos — multi-tab', () => {
   test('same user in two tabs — each tab establishes its own SSE stream', async ({ page, context, guest, signIn }) => {
     const g = await guest('Twin');
 
-    // Count each tab's own EventSource open (GET /api/v1/stream?ticket=…). Asserting
-    // *connection establishment* is fast and reliable; asserting event *delivery* would
-    // depend on the reverse proxy's ~30s SSE buffering and isn't worth the flake here.
-    const streamOpens = (p: import('@playwright/test').Page) => {
-      let n = 0;
-      p.on('request', (req) => {
-        if (req.method() === 'GET' && req.url().includes('/api/v1/stream?')) n++;
-      });
-      return () => n;
-    };
-
-    const opens1 = streamOpens(page);
+    // Count each tab's own EventSource open. Asserting *connection establishment* is
+    // fast and reliable; asserting event *delivery* would depend on the reverse proxy's
+    // ~30s SSE buffering and isn't worth the flake here.
+    const opens1 = trackStreamOpens(page);
     await signIn(page, g); // → /feed, connectSse() on mount
     await expect.poll(opens1, { timeout: 10_000 }).toBeGreaterThanOrEqual(1);
 
     const tab2 = await context.newPage();
-    const opens2 = streamOpens(tab2);
+    const opens2 = trackStreamOpens(tab2);
     await signIn(tab2, g);
     await expect.poll(opens2, { timeout: 10_000 }).toBeGreaterThanOrEqual(1);