docs(e2e): clear the stale known-issue markers, root cause found

checkout-request-shape.spec.ts and checkout-idempotent-click.spec.ts were
flagged known-failing pending investigation; dda0a3d found and fixed the
actual cause (circular DI in apiHeadersInterceptor). Update the comments
and README so they no longer point at an unresolved mystery.

e2e/checkout-request-shape.spec.ts

@@ -81,19 +81,14 @@ async function seedCart(page: Page): Promise<void> {
 }
 
 async function fakeCustomerSession(page: Page, context: import('@playwright/test').BrowserContext): Promise<void> {
-  // KNOWN ISSUE, NOT RESOLVED (2026-08-21): this test currently fails.
-  // Traced with page.on('request'): the customer-session check
-  // (AuthService.checkSession -> getStoredWebSessionID) never fires at all
-  // once Angular bootstraps on this page, even though the cookie is
-  // confirmed present via context.cookies() and via document.cookie read
-  // from a plain (non-Angular) page on the same origin immediately before.
-  // Switching { domain, path } to { url } here did not fix it - kept anyway
-  // since it is the more correct form regardless. Something in the app's
-  // own bootstrap/DI path is not seeing a cookie that unambiguously exists
-  // in the browser; root cause not yet found. Do not trust a green run of
-  // this specific test until this is root-caused - the checkout REQUEST
-  // SHAPE assertions this test makes are still correct on paper, just
-  // currently unverifiable through this harness.
+  // Root-caused and fixed 2026-08-21 (see api-headers.interceptor.ts):
+  // apiHeadersInterceptor injected AuthService to attach a WebSessionID
+  // header, but AuthService's own constructor makes the exact
+  // GET /users/sessions/:id call this interceptor runs on, which threw
+  // NG0200 (circular dependency) mid-construction on every page load -
+  // swallowed silently, read as "session invalid," cookie cleared
+  // immediately. The { url } cookie form below is unrelated to that bug but
+  // is still the more correct form, so it stays.
   await context.addCookies([
     {
       name: 'webSessionID',