Perf: inject auth token at launch to skip the UI login (~26-50% faster)

Measured: ~half of every authenticated test was fixed setup, dominated by the
UI login (typing email+password, keyboard/SecureField dance, ~8-12s). The test
already creates the account via API and holds its real Kratos session token —
so instead of typing credentials, pass the token as a launch arg and boot the
app already authenticated.

- App (UITestRuntime + iOSApp): reads --ui-test-session-token; after the
  --reset-state clear, calls DataManager.setAuthToken(token) and replicates the
  post-login init the UI login path runs (getCurrentUser + initializeLookups +
  getMyResidences + getTasks) so owner-gated/data-gated screens (residence
  detail delete + manage-users, pickers, lists) work on boot. Guarded by
  UITestRuntime.isEnabled — no effect on production.
- AuthenticatedUITestCase: in fresh-account mode, create the account + seed its
  preconditions BEFORE launch, expose the token via additionalLaunchArguments,
  and drop the UI login. Legacy (usesFreshAccount=false) suites still UI-login.

Measured per-test medians: Contractor 34s -> 25s; Task (uses lookups) ~34s ->
16s. TESTING.md updated. All affected suites pass; 0 leaked accounts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

iosApp/HoneyDueUITests/TESTING.md

@@ -34,7 +34,12 @@ which in `setUp`:
 
 1. mints a **unique, pre-verified Kratos identity** —
    `uit_<domain>_<uuid>@test.honeydue.local` (see `Core/Fixtures/TestAccount.swift`),
-2. logs the app in as that account,
+2. boots the app **already authenticated** by passing the account's real Kratos
+   token as `--ui-test-session-token` (the app reads it in `UITestRuntime` and
+   calls `DataManager.setAuthToken`). This skips the slow, flaky UI login
+   (~8–12s/test) — the app lands straight on the main tabs. Logged-OUT suites
+   (login/registration/onboarding) still drive the real login UI, since that's
+   what they test,
 3. exposes `session` / `cleaner` / `account` for seeding under its **own** token,
 
 and in `tearDown` calls `account.delete()`, which **cascades all of the