Fix e2e test infrastructure and app bugs found by Playwright

Fixes:
- Add frontends/web/ to sys.path in e2e conftest for temp_storage import
- Fix .fieldwitness → .fwmetadata in e2e conftest
- Fix NameError in /health endpoint (auth_is_authenticated → is_authenticated)
- Fix NameError in /login POST (config → app.config["FIELDWITNESS_CONFIG"])
- Add session-scoped admin_user fixture for reliable test ordering
- Fix navigation test assertions (health fetch URL, title checks, logout)
- Increase server startup timeout and use /login for health polling

Status: 17/39 e2e tests passing (auth + navigation). Remaining failures
are selector/assertion mismatches needing template-specific tuning.
350 unit/integration tests continue passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontends/web/app.py

@@ -245,7 +245,7 @@ def create_app(config: FieldWitnessConfig | None = None) -> Flask:
         """
         # Anonymous callers get minimal response to prevent info leakage
         # (deadman status, key presence, memory, etc. are operational intel)
-        if not auth_is_authenticated():
+        if not is_authenticated():
             from flask import jsonify
             return jsonify({"status": "ok", "version": __import__("fieldwitness").__version__})
 
@@ -500,9 +500,11 @@ def _register_stego_routes(app: Flask) -> None:
             username = request.form.get("username", "")
             password = request.form.get("password", "")
 
-            # Check lockout
-            max_attempts = config.login_lockout_attempts
-            lockout_mins = config.login_lockout_minutes
+            # Check lockout — read from app.config since _register_stego_routes
+            # is a module-level function without access to create_app's config.
+            _fw_config = app.config.get("FIELDWITNESS_CONFIG")
+            max_attempts = _fw_config.login_lockout_attempts if _fw_config else 5
+            lockout_mins = _fw_config.login_lockout_minutes if _fw_config else 15
             now = time.time()
             window = lockout_mins * 60
             attempts = _login_attempts.get(username, [])