test(e2e): add Playwright suite for auth + CSRF + visibility fixes

Covers the security fixes that landed across both repos:

- auth.spec.ts: login persists nz-jwt cookie and getProfile succeeds;
  password change bumps TokenVersion + revokes the old cookie so the
  pre-change JWT can no longer auth (regression guard for the
  keyId+session backend rewrite).
- cron-csrf.spec.ts: POST /api/v1/cron/:id/manual succeeds while GET
  is no longer routable (regression guard for the cron CSRF fix).
- fm-csrf.spec.ts: POST /api/v1/file is reachable while GET is no
  longer routable (regression guard for the FM CSRF fix).
- visibility.spec.ts: an anonymous caller cannot see a server-group
  that contains zero guest-visible servers (regression guard for the
  server-group leak fix).

Fixtures wrap the noisy login + cleanup boilerplate. tsconfig is
scoped to tests/e2e so the suite stays out of the production tsc
project graph.

Playwright config starts the Vite dev server (npm run dev) and
expects a backend reachable at the URL Vite proxies to. CI workflow
follow-up commit wires the backend up.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

playwright.config.ts

@@ -0,0 +1,32 @@
+import { defineConfig, devices } from "@playwright/test"
+
+const baseURL = process.env.E2E_BASE_URL || "http://localhost:5173"
+
+export default defineConfig({
+    testDir: "./tests/e2e",
+    fullyParallel: false,
+    forbidOnly: !!process.env.CI,
+    retries: process.env.CI ? 1 : 0,
+    workers: 1,
+    reporter: process.env.CI ? [["github"], ["html", { open: "never" }]] : "list",
+    use: {
+        baseURL,
+        trace: "on-first-retry",
+        screenshot: "only-on-failure",
+        video: process.env.CI ? "retain-on-failure" : "off",
+    },
+    projects: [
+        {
+            name: "chromium",
+            use: { ...devices["Desktop Chrome"] },
+        },
+    ],
+    webServer: process.env.E2E_SKIP_WEBSERVER
+        ? undefined
+        : {
+            command: "npm run dev",
+            url: baseURL + "/dashboard/login",
+            reuseExistingServer: !process.env.CI,
+            timeout: 120_000,
+        },
+})