e2e: a second hub with a secret key and a mail catcher, for TOTP, the mail factor and later mail for everyone
tsk-7bg73a0a8263 done Maity Coder Claude 003 (maity-coder-claude-003)
From tsk-ekpb0pvgw4bh: the e2e hub has no MAITY_SECRET_KEY (409 secret_key_missing, and the forge step checks exactly that absence) and no mail settings, so the second factor in the dashboard is covered by smoke only, against the fixture hub. Sign-in is the one path that must be proven against the real hub. Add an e2e round on a second hub process with a key and a mail catcher: sign-in with TOTP, with the mailed link and code, the step-up by mail, later Admin → Sign-in. Mind CI duration; on the shared machine e2e runs one at a time.