fix(e2e): fix Settings heading and WebKit SSO redirect failures

[pikann]

Summary

Fixes the Playwright failures in E2E run 36327807787, which failed on all 5 browser jobs.

1. Settings spec: heading renamed (all browsers)

The SSO work (8799c12) renamed the Settings page heading from "Workspace Branding" to "Workspace Settings". settings.spec.ts and settings.feature still looked for the old heading, so 9 tests failed on every browser. This PR updates them to use "Workspace Settings".

2. SSO spec: WebKit rejects a fulfilled 302 (webkit, mobile-safari)

A first-time user gets a new account failed with:

route.fulfill: Cannot fulfill with redirect status: 302

routeMockProvider intercepts Paca's SSO login redirect and rewrites its Location to the mock provider's public port. WebKit won't let a test answer a page load with a redirect status. The route now answers 200 with a <meta http-equiv="refresh"> page that forwards to the rewritten URL. It still sends the original headers, including Set-Cookie: sso_state, so the sign-in stays tied to the same browser. This works in every browser.

Test plan

• settings.spec.ts + sso.spec.ts pass locally on chromium (18/18)
• webkit / mobile-safari: confirm in CI (not run locally; the WebKit browser download didn't finish)
• Full E2E workflow is green

Not in scope

Four tests failed once and passed on retry in that run, so they're flaky rather than broken:

• conversations.spec.ts:979 (chromium)
• changelog.spec.ts:197 (mobile-safari)
• docs.spec.ts:350 (mobile-safari)
• management.spec.ts:291 (mobile-safari)

They didn't fail any job, and this PR doesn't change them.

🤖 Generated with Claude Code

[pullfrog]

This run was cancelled 🛑

The workflow was cancelled before completion. Please check the link below for details.

  ^{｜ View workflow run ｜ via Pullfrog ｜ 𝕏}