Add merge-validation tests for authenticated flows and frontend contract shape

Made-with: Cursor