…01 signed app back out)

The deep-link login in this spec broadcasts loadUser() to every window, but
the test only mocked /api/user in the home window. A foreign window then hit
the real network with the fake token, got a 401, and the auth interceptor
broadcast "screenpipe-auth-signout", clearing the freshly-logged-in home
window too. On slow Windows CI that 401 landed between the "logged in as" wait
and the email assertion, so Phase A setup flapped to "not logged in" and the
spec failed about half the time on Windows only (Linux/macOS always passed).

Install the /api/user mock in every window (forEachWindow helper) so no real
401 can fire, and restore fetch everywhere on teardown so the mock can't leak
into the next spec in the shared session. Also tighten Phase A's wait to poll
for the email itself, not just "logged in as", as defense in depth. The core
Phase B regression assertion is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Replaces the earlier forEachWindow approach, which poisoned the shared
WebDriver session (switching across ~7 windows hung the after-hook and
cascaded "Failed to create a session" to later specs).

Root cause of the flake: the deep-link login used a global emit, so every
window's deep-link handler ran loadUser(api_key). Only the home window has the
/api/user mock; the others hit the real network with the fake token, 401, and
the auth interceptor broadcast "screenpipe-auth-signout" -> wrote user:null
into the shared settings store -> cleared the freshly-logged-in home window.
On slow CI that landed mid-login, so Phase A flapped to "not logged in"
(~50% on Windows, also seen on Linux).

Fix: emit the deep-link with emitTo("home", ...) so every loadUser stays in
the one mocked window. No foreign 401, no cross-window signout, no window
switching. The resurrection race this spec guards is per-window (home fires
the slow loadUser, home logs out, home's generation guard aborts the late
write), so coverage is unchanged. Also poll Phase A for the email itself, not
just "logged in as", as defense in depth.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>