fix: add E2E opt-out for fail-loud secret/DB-URL guards

Playwright runs the server via `react-router serve` with
NODE_ENV=production but against a local dev Postgres and local cookie
secrets. The guards added in 5a7bb76 refused to start under that
configuration. `E2E=true` (already set by the CI E2E job) is now the
explicit opt-out: in real production this env var is never set, so the
guard still bites.

apps/journal/app/lib/config.server.ts

@@ -18,7 +18,10 @@ export function getOrigin(): string {
  */
 export function requireSecret(name: string, devFallback: string): string {
   const value = process.env[name];
-  const isProd = process.env.NODE_ENV === "production";
+  // Playwright runs `react-router serve` (NODE_ENV=production) against a
+  // local stack. E2E=true is the explicit opt-out so the guard still
+  // bites in real prod deploys.
+  const isProd = process.env.NODE_ENV === "production" && process.env.E2E !== "true";
   if (isProd) {
     if (!value || value === devFallback) {
       throw new Error(