e2e: throwaway-account cleanup silently no-ops against a localhost target

Found during the adversarial review of the e2e suite; not addressed in #1572.

`signup-verification.anon.spec.ts` → `deleteThrowawayAccount()` calls `page.request.get("/User/current")`, which resolves against Playwright's `baseURL`.

- Against the **deployed** target that is correct — app and API share an origin, so cleanup works (verified in the trusted lane: `[cleanup] deleted throwaway account usr-…`).
- Against a **localhost** target it is not. `pnpm test:local` (`http://localhost:5173`) and the PR-lane sandbox (`http://127.0.0.1:4173`) serve the SPA from Vite while the API lives elsewhere (stage, per `.env.local`). The request hits the Vite server, gets `200` + `index.html`, passes the `meRes.ok()` check, then throws on `meRes.json()` — which is caught and logged as a warning.

Net effect: **every local round-trip run leaks a real account on the shared stage tenant**, with no test failure and only a `console.warn`.

Fix ideas:
- Resolve `/User/current` against an explicit API origin (e.g. `PLAYWRIGHT_API_BASE_URL`, defaulting to `baseURL`) rather than assuming same-origin.
- Assert the response is JSON (`content-type`) before parsing, and make a cleanup failure loud — print the leaked address so it can be swept.

Related: the account-churn note in `e2e/README.md` should say cleanup is deployed-target-only until this is fixed.

Start in e2e/signup-verification.anon.spec.ts at deleteThrowawayAccount(), then inspect .env.local and the account-churn note in e2e/README.md. Run pnpm test:local to reproduce the localhost behavior. Done means cleanup targets the configured API origin, rejects the HTML response clearly, reports the leaked address, and documents the supported targets.

Written by the indexing model from the issue text.