test: self-contained local test account + urlencoded login

Add a dedicated, gitignored testrunner account auto-created by the suite
(make test-account, also invoked from global-setup) so `make test` no longer
needs the real account in .env. The target uses --admin-type both so the
account has admin.login for the gpx-manager specs. test-post.sh switches its
login POST to --data-urlencode to survive special chars in credentials.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU

.env.example

@@ -26,11 +26,15 @@
 UID=1000
 GID=1000
 
-# Local Grav dev server + test login, used by `make test-post` / `make test`
-# (scripts/test-post.sh). Must be a valid Grav site login on the local instance.
+# Local Grav dev server. GRAV_BASE_URL is used by the Playwright suite and
+# scripts/test-post.sh.
 GRAV_BASE_URL=http://localhost:8081
-GRAV_TEST_USER=your-local-grav-user
-GRAV_TEST_PASS=your-local-grav-password
+# Test login for `make test` — OPTIONAL. If unset, the suite auto-creates and
+# uses a dedicated local-only account (testrunner / Testpass1234), gitignored so
+# it is never pushed to prod (see `make test-account`). Override only to test as
+# a different account; keep the password free of shell/Make/URL-special chars.
+# GRAV_TEST_USER=testrunner
+# GRAV_TEST_PASS=Testpass1234
 GRAV_USER_DIR=/absolute/path/to/travel-blog-intotheeast/user
 
 # travel-memories service (docker-compose `env_file: .env`). Fill in whatever
@@ -55,7 +59,7 @@ WEBROOT=/home/example.com/public_html
 SITE_CONFIG_DIR=/home/example.com/site-config
 
 # Grav version installed by scripts/server-install.sh (remote-install).
-GRAV_VERSION=2.0.0-rc.10
+GRAV_VERSION=2.0.4
 
 # Repos cloned/pulled on the server.
 USER_REPO=https://gitea.example.com/org/intotheeast-user.git