Re-architect iOS XCUITest suite: per-test isolation + domain organization

Migrate the XCUITest suite off the legacy shared-account model (and the
prior Django-style auth assumptions) to a parallel-safe, domain-organized
architecture, validated end-to-end against the live Kratos stack.

Isolation (parallel-safe by construction):
- Core/Fixtures/TestAccount.swift: each test mints its own pre-verified
  Kratos identity (uit_<domain>_<uuid>@test.honeydue.local), logs in, seeds
  under its own token, and deletes the identity in teardown (cascading all
  data + clearing Kratos). No shared testuser; parallel workers no longer race.
- AuthenticatedUITestCase rewritten to that model (member surface preserved);
  adds requiresResidence / seedAccountPreconditions to seed UI-gated data
  BEFORE login (a fresh account is empty at login).

Organization (255 tests preserved, none dropped):
- 21 domain suites under Auth/ Onboarding/ Residence/ Task/ Contractor/
  Document/ Sharing/ Navigation/ Smoke/ CrossCutting/ E2E/, consistent
  <Domain>UITests naming. Removes the Suite1..11 / AAA_ / ZZ_ / Tests/Rebuild
  naming chaos and the overlapping task/residence/auth suites.

Runner + test plans:
- run_ui_tests.sh: Smoke gate -> Seed -> Parallel(8 workers) -> Sweep. The
  parallel phase runs the whole target minus phase-managed suites via
  -skip-testing, so new suites auto-include (no hand-maintained list to drift).
  Drops the 2-worker cap and Suite6 isolation (isolation made them moot).
- HoneyDueUITests.xctestplan skips the 4 phase-managed suites; adds Smoke.xctestplan.

Kratos auth fixes folded in (login/verify/reset endpoints removed under Kratos):
real Mailpit verification codes replace the obsolete fixed "123456"; teardown
deletes Kratos identities; admin-panel login uses the correct seeded password.

Build green; isolation, parallelism, and the precondition/sharing migrations
validated against the live stack (0 leaked accounts).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

iosApp/HoneyDueUITests/Framework/TestFlows.swift

@@ -65,7 +65,9 @@ enum TestFlows {
         loginButton.waitUntilHittable(timeout: 10).tap()
     }
 
-    /// Drive the full forgot password → verify code → reset password flow using the debug code.
+    /// Drive the full forgot password → verify code → reset password flow.
+    /// The recovery code is read from Mailpit — password reset is a Kratos
+    /// recovery flow now, so Kratos emails a real 6-digit code (no fixed code).
     static func completeForgotPasswordFlow(
         app: XCUIApplication,
         email: String,
@@ -80,10 +82,11 @@ enum TestFlows {
         forgotScreen.enterEmail(email)
         forgotScreen.tapSendCode()
 
-        // Step 2: Enter debug verification code
+        // Step 2: Enter the real Kratos recovery code (emailed → Mailpit locally)
         let verifyScreen = VerifyResetCodeScreen(app: app)
         verifyScreen.waitForLoad()
-        verifyScreen.enterCode(TestAccountAPIClient.debugVerificationCode)
+        let code = TestAccountAPIClient.latestVerificationCode(for: email) ?? ""
+        verifyScreen.enterCode(code)
         verifyScreen.tapVerify()
 
         // Step 3: Enter new password