Your login endpoint sets a session cookie, and the next request in the same test must be authenticated with it. What is the supertest way to do this?

Use const agent = request.agent(app). The agent stores cookies from each response and sends them on its later requests. This is how you test session-based flows, like logging in and then calling a protected route.

"Call request(app) twice; supertest shares cookies between all requests automatically" is wrong. Each request(app) call is independent and keeps no state. Copying the set-cookie header into .set('Cookie', ...) by hand also works.