fix(e2e): add Origin header to global setup API calls

better-auth rejects requests without an Origin header (403).
Add Origin: baseURL to sign-up, sign-in, and storage seed requests
in the global setup script.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

e2e/global-setup.ts

@@ -9,7 +9,7 @@ async function globalSetup() {
   // Register first user → becomes admin
   const signUp = await fetch(`${baseURL}/api/auth/sign-up/email`, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', Origin: baseURL },
     body: JSON.stringify({
       name: 'E2E Admin',
       email: 'e2e-admin@test.local',
@@ -27,7 +27,7 @@ async function globalSetup() {
   // Sign in to get session cookie
   const signIn = await fetch(`${baseURL}/api/auth/sign-in/email`, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', Origin: baseURL },
     body: JSON.stringify({
       email: 'e2e-admin@test.local',
       password: 'password123456',