Fix Cypress: disable allowCypressEnv, hardcode test token, fix CI server wait

- cypress.config.js: set allowCypressEnv: false
- Replace Cypress.env('ADMIN_TOKEN') with hardcoded test DB token
- CI: use fixed venv path, retry loop for server readiness

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/cypress.config.js

@@ -9,5 +9,6 @@ export default defineConfig({
     viewportHeight: 800,
     video: true,
     videoCompression: false,
+    allowCypressEnv: false,
   },
 })

frontend/cypress/e2e/admin-flow.cy.js

@@ -1,48 +1,39 @@
 describe('Admin Flow', () => {
+  const ADMIN_TOKEN = 'c86ae7afbe10fabe3c1d5e1a7fee74feaadfd5dc7be2ab62'
+
   beforeEach(() => {
-    const token = Cypress.env('ADMIN_TOKEN')
-    if (!token) {
-      cy.log('ADMIN_TOKEN not set, skipping admin tests')
-      return
-    }
     cy.visit('/', {
       onBeforeLoad(win) {
-        win.localStorage.setItem('oil_auth_token', token)
+        win.localStorage.setItem('oil_auth_token', ADMIN_TOKEN)
       }
     })
-    // Wait for app to load with admin privileges
     cy.get('.nav-tab', { timeout: 10000 }).should('have.length.gte', 6)
   })
 
   it('shows admin-only tabs', () => {
-    if (!Cypress.env('ADMIN_TOKEN')) return
     cy.get('.nav-tab').contains('操作日志').should('be.visible')
     cy.get('.nav-tab').contains('Bug').should('be.visible')
     cy.get('.nav-tab').contains('用户管理').should('be.visible')
   })
 
   it('can access manage recipes page', () => {
-    if (!Cypress.env('ADMIN_TOKEN')) return
     cy.get('.nav-tab').contains('管理配方').click()
     cy.url().should('include', '/manage')
   })
 
   it('can access audit log page', () => {
-    if (!Cypress.env('ADMIN_TOKEN')) return
     cy.get('.nav-tab').contains('操作日志').click()
     cy.url().should('include', '/audit')
     cy.contains('操作日志').should('be.visible')
   })
 
   it('can access user management page', () => {
-    if (!Cypress.env('ADMIN_TOKEN')) return
     cy.get('.nav-tab').contains('用户管理').click()
     cy.url().should('include', '/users')
     cy.contains('用户管理').should('be.visible')
   })
 
   it('can access bug tracker page', () => {
-    if (!Cypress.env('ADMIN_TOKEN')) return
     cy.get('.nav-tab').contains('Bug').click()
     cy.url().should('include', '/bugs')
     cy.contains('Bug').should('be.visible')

frontend/cypress/e2e/api-health.cy.js

@@ -46,12 +46,7 @@ describe('API Health Check', () => {
   })
 
   it('GET /api/me returns authenticated user with valid token', () => {
-    // Use the admin token from env or skip
-    const token = Cypress.env('ADMIN_TOKEN')
-    if (!token) {
-      cy.log('ADMIN_TOKEN not set, skipping auth test')
-      return
-    }
+    const token = 'c86ae7afbe10fabe3c1d5e1a7fee74feaadfd5dc7be2ab62'
     cy.request({
       url: '/api/me',
       headers: { Authorization: `Bearer ${token}` }