test(e2e): add Playwright suite for auth + CSRF + visibility fixes

Covers the security fixes that landed across both repos:

- auth.spec.ts: login persists nz-jwt cookie and getProfile succeeds;
  password change bumps TokenVersion + revokes the old cookie so the
  pre-change JWT can no longer auth (regression guard for the
  keyId+session backend rewrite).
- cron-csrf.spec.ts: POST /api/v1/cron/:id/manual succeeds while GET
  is no longer routable (regression guard for the cron CSRF fix).
- fm-csrf.spec.ts: POST /api/v1/file is reachable while GET is no
  longer routable (regression guard for the FM CSRF fix).
- visibility.spec.ts: an anonymous caller cannot see a server-group
  that contains zero guest-visible servers (regression guard for the
  server-group leak fix).

Fixtures wrap the noisy login + cleanup boilerplate. tsconfig is
scoped to tests/e2e so the suite stays out of the production tsc
project graph.

Playwright config starts the Vite dev server (npm run dev) and
expects a backend reachable at the URL Vite proxies to. CI workflow
follow-up commit wires the backend up.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

package.json

@@ -11,7 +11,9 @@
         "lint:fix": "eslint --fix .",
         "format": "prettier --write .",
         "test": "vitest run",
-        "preview": "vite preview"
+        "preview": "vite preview",
+        "e2e": "playwright test",
+        "e2e:install": "playwright install --with-deps chromium"
     },
     "dependencies": {
         "@hookform/resolvers": "^5.2.2",
@@ -66,6 +68,7 @@
     },
     "devDependencies": {
         "@eslint/js": "^9.37.0",
+        "@playwright/test": "^1.60.0",
         "@testing-library/dom": "^10.4.1",
         "@testing-library/react": "^16.3.2",
         "@types/node": "^24.7.0",