fix(e2e): implement automatic cleanup of test form submissions with authorized secret header

src/payload/collections/FormSubmissions.ts

@@ -9,9 +9,19 @@ export const FormSubmissions: CollectionConfig = {
   },
   access: {
     // Only Admins can view and delete leads via dashboard.
-    read: ({ req: { user } }) => Boolean(user) || process.env.NODE_ENV === 'development',
-    update: ({ req: { user } }) => Boolean(user) || process.env.NODE_ENV === 'development',
-    delete: ({ req: { user } }) => Boolean(user) || process.env.NODE_ENV === 'development',
+    // E2E scripts can bypass if they provide the correct secret header.
+    read: ({ req }) => {
+      const isE2E = req.headers.get('x-e2e-secret') === process.env.PAYLOAD_SECRET;
+      return Boolean(req.user) || isE2E || process.env.NODE_ENV === 'development';
+    },
+    update: ({ req }) => {
+      const isE2E = req.headers.get('x-e2e-secret') === process.env.PAYLOAD_SECRET;
+      return Boolean(req.user) || isE2E || process.env.NODE_ENV === 'development';
+    },
+    delete: ({ req }) => {
+      const isE2E = req.headers.get('x-e2e-secret') === process.env.PAYLOAD_SECRET;
+      return Boolean(req.user) || isE2E || process.env.NODE_ENV === 'development';
+    },
     // Next.js server actions handle secure inserts natively. No public client create access.
     create: () => false,
   },