Run the dockerised e2e suite with write auth enabled

Real clients now authenticate every local publish against a static mock
OIDC issuer, and each type checks unauthenticated publishes are refused
while anonymous reads keep working.

docker-compose.e2e.yml

@@ -21,7 +21,17 @@ services:
     volumes:
       - ./e2e-docker/mirror-conf/b.conf:/etc/nginx/conf.d/default.conf:ro,z
 
+  # Static OIDC issuer gating writes; the suite's TestMain writes jwks.json.
+  mockoidc:
+    image: nginx:alpine
+    volumes:
+      - ./e2e-docker/oidc:/usr/share/nginx/html:ro,z
+
   artifactapi:
+    environment:
+      ARTIFACTAPI_OIDC_ISSUER: http://mockoidc
+      ARTIFACTAPI_OIDC_AUDIENCE: artifactapi
+      ARTIFACTAPI_AUTH_UPLOADS: "true"
     # The host port is set via ARTIFACTAPI_PORT (see scripts/docker-e2e.sh),
     # defaulting to 8000; the e2e run uses 8001 to avoid colliding with a
     # locally-running instance.
@@ -32,3 +42,5 @@ services:
         condition: service_started
       mockupstreamb:
         condition: service_started
+      mockoidc:
+        condition: service_started