Three new tests in apps/contrail-e2e, each running in-process against a real devnet PDS + PLC + Postgres with spaces enabled: - spaces-auth.test.ts: real service-auth JWT minted via com.atproto.server.getServiceAuth is accepted; wrong aud and wrong lxm binding are rejected. Exercises the full verifier path (PDS signs with the user's PLC-published key, Contrail resolves the key from devnet PLC, @atcute/xrpc-server verifies the signature) — the existing package-level spaces tests all use a fakeAuth header and never touch this path. - spaces-firehose-invisibility.test.ts: records written via {ns}.space.putRecord do not appear on the ATProto firehose. Uses a direct-to-PDS createRecord as a positive control so a silently broken subscriber can't make the negative assertion vacuous. - spaces-table-isolation.test.ts: a space putRecord lands in spaces_records_<collection> with the public records_<collection> table empty for the same caller — proves the store-level separation that the spaces privacy model depends on. helpers.ts gains CONTRAIL_SERVICE_DID, createDevnetResolver (PlcDid- DocumentResolver pointed at devnet PLC), and mintServiceAuthJwt. Adds @atcute/identity-resolver, @atcute/jetstream, and @atcute/lexicons as direct devDependencies.