feat(e2e): add TOTP 2FA support to export-session

[fullsend-ai-coder]

The botsend GitHub account now requires two-factor authentication, which causes the export-session Playwright flow to fail at the 2FA challenge screen. This adds support for generating and submitting TOTP codes during login via a new E2E_GITHUB_TOTP_SECRET env var.

When the 2FA challenge page is detected after password submission, the tool generates a 6-digit TOTP code from the secret and fills it into the authenticator app input field. If 2FA is required but no secret is configured, it fails with a clear error message.

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

---

Closes #486

Post-script verification

• Branch is not main/master (agent/486-e2e-totp-support)
• Secret scan passed (gitleaks — 1fbfdd9602b04991a3646a3358821128bf9185aa..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://afe4c0a0-site.fullsend-ai.workers.dev

Commit: 55c9103ffea3a7184a1e534d9a988f2979bc388c

[fullsend-ai-review]

Review

Findings

Low

• [docs-currency] CLAUDE.md — The "Running e2e tests" section documents three credential env vars (E2E_GITHUB_PASSWORD, E2E_GITHUB_PASSWORD_FILE, E2E_GITHUB_SESSION_FILE) but does not mention the new E2E_GITHUB_TOTP_SECRET variable. Developers consulting CLAUDE.md as a primary reference will not discover this option.
  Remediation: Add E2E_GITHUB_TOTP_SECRET to the credential options list in the "Running e2e tests" section, noting it is required when the GitHub account has 2FA enabled.

• [docs-currency] docs/ADRs/0010-stored-session-for-e2e-browser-auth.md:138 — States "If the test account enables 2FA, the session export must happen after the 2FA step" which implies a manual process. The export-session tool now handles 2FA automatically when E2E_GITHUB_TOTP_SECRET is set. The Consequences section (line 132) also notes "Two repo secrets are required" but a third (E2E_GITHUB_TOTP_SECRET) may now be needed for session regeneration.
  Remediation: Update the ADR consequences to reflect that TOTP is handled automatically by the export-session tool and note the optional third secret.

[fullsend-ai-review]

Review follow-ups

Created follow-up issues for actionable non-blocking review findings:

• #1204 — The "Running e2e tests" section documents three credential env vars (E2E_GITHUB_PASSWORD, E2E_GITHUB_PASSWORD_FILE, E2E_GITHUB_SESSION_FILE) but does not mention the new E2E_GITHUB_TOTP_SECRET variable. Developers consulting CLAUDE.md as a primary reference will not discover this option.
• #1205 — States "If the test account enables 2FA, the session export must happen after the 2FA step" which implies a manual process. The export-session tool now handles 2FA automatically when E2E_GITHUB_TOTP_SECRET is set. The Consequences section also notes "Two repo secrets are required" but a third (E2E_GITHUB_TOTP_SECRET) may be needed for session regeneration.

[ralphbean]

Closing in favor of #1211