test(e2e): add Playwright suite for auth + CSRF + visibility fixes

Covers the security fixes that landed across both repos:

- auth.spec.ts: login persists nz-jwt cookie and getProfile succeeds;
  password change bumps TokenVersion + revokes the old cookie so the
  pre-change JWT can no longer auth (regression guard for the
  keyId+session backend rewrite).
- cron-csrf.spec.ts: POST /api/v1/cron/:id/manual succeeds while GET
  is no longer routable (regression guard for the cron CSRF fix).
- fm-csrf.spec.ts: POST /api/v1/file is reachable while GET is no
  longer routable (regression guard for the FM CSRF fix).
- visibility.spec.ts: an anonymous caller cannot see a server-group
  that contains zero guest-visible servers (regression guard for the
  server-group leak fix).

Fixtures wrap the noisy login + cleanup boilerplate. tsconfig is
scoped to tests/e2e so the suite stays out of the production tsc
project graph.

Playwright config starts the Vite dev server (npm run dev) and
expects a backend reachable at the URL Vite proxies to. CI workflow
follow-up commit wires the backend up.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

tests/e2e/fm-csrf.spec.ts

@@ -0,0 +1,21 @@
+import { expect } from "@playwright/test"
+
+import { test } from "./fixtures"
+
+test("file manager creation only accepts POST", async ({ adminPage: page }) => {
+    const getResp = await page.request.get("/api/v1/file?id=1", {
+        failOnStatusCode: false,
+    })
+    expect(
+        getResp.status() === 404 || getResp.status() === 405,
+        `GET /api/v1/file must no longer be routable (got ${getResp.status()})`,
+    ).toBeTruthy()
+
+    const postResp = await page.request.post("/api/v1/file?id=1", {
+        failOnStatusCode: false,
+    })
+    expect(postResp.status()).toBe(200)
+    const body = await postResp.json()
+    expect(body.success, "without a connected agent server the POST surfaces a Service error, but the route is reachable").not.toBe(true)
+    expect(body.error).toBeTruthy()
+})