test: self-contained local test account + urlencoded login

Add a dedicated, gitignored testrunner account auto-created by the suite
(make test-account, also invoked from global-setup) so `make test` no longer
needs the real account in .env. The target uses --admin-type both so the
account has admin.login for the gpx-manager specs. test-post.sh switches its
login POST to --data-urlencode to survive special chars in credentials.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU

scripts/test-post.sh

@@ -49,7 +49,10 @@ LOGIN_NONCE=$(echo "$LOGIN_HTML" | grep -o 'name="login-form-nonce" value="[^"]*
 LOGIN_STATUS=$(curl -sf -o /dev/null -w "%{http_code}" \
     -c "$COOKIE_JAR" -b "$COOKIE_JAR" \
     -L \
-    -d "username=${USER}&password=${PASS}&login-form-nonce=${LOGIN_NONCE}&task=login.login" \
+    --data-urlencode "username=${USER}" \
+    --data-urlencode "password=${PASS}" \
+    --data-urlencode "login-form-nonce=${LOGIN_NONCE}" \
+    --data-urlencode "task=login.login" \
     "$BASE_URL/login")
 
 # After login, fetch /post and verify we see the post form (not the login form)