feat(e2e): Playwright suite — 134 tests across 9 spec areas + UA matrix

Adds an end-to-end Playwright test suite under e2e/ that spins up an
isolated docker-compose stack (Postgres :55432, Caddy :3101, backend with
EVENTSNAP_TEST_MODE=1, SvelteKit adapter-node frontend) and exercises the
SvelteKit app against the real Rust backend.

Phase 1 — happy paths covering every documented USER_JOURNEYS.md flow:
  01-auth/      join, recover, admin login, leave event, PIN lockout
  02-upload/    gallery picker (API path), rate-limit + admin toggle
  03-feed/      like/comment SSE, filters, SSE reconnect on visibility
  04-host/      event lock API, ban/unban, promote
  05-admin/     config validation, foundational authz guards, stats
  06-export/    /export status + download stub
  __smoke/      cross-UA happy-path (runs on every UA project)

Phase 2 — adversarial + browser chaos:
  07-adversarial/  XSS payloads (6 × display name path), SQLi shapes,
                   length / encoding / RTL override / NUL byte;
                   file-upload boundaries (ELF body claimed as JPEG,
                   oversize vs max_image_size_mb, zero-byte, NUL
                   filename, path-traversal, SVG-with-script);
                   JWT alg:none, signature/payload tamper, expired
                   session, PIN brute-force (serial + parallel),
                   admin password brute-force; deep authz (cross-user
                   delete, banned user across like/comment/feed-read,
                   host→admin escalation); small-scale DDoS (20× /join,
                   10MB comment body, 10 concurrent SSE).
  08-browser-chaos/ localStorage / sessionStorage / cookie purge,
                    IndexedDB drop mid-session, offline → reconnect,
                    slow-3G, 503 flakes, 429 with no retry storm,
                    multi-tab same/different user, no-JS, hostile CSS,
                    clock skew ±1h / -2d, localStorage quota exhausted.

Phase 3 — mobile gestures (runs only on chromium-mobile / Pixel 7):
  09-mobile/    touch-target ≥44px audit, env(safe-area-inset-bottom)
                structural check, long-press (FeedListCard → ContextSheet,
                quick-tap negation, click-suppression), double-tap
                (feed card like + lightbox heart-burst, via synthetic
                pointer events to bypass the first-tap-fires-click trap),
                viewport reflow (portrait/landscape/narrow/phablet),
                plus fixme stubs documenting planned gestures (swipe
                lightbox L/R, swipe-down dismiss, pull-to-refresh,
                long-press-comment).

Cross-UA matrix (chromium-engine projects run @smoke only):
  chromium-pixel7, chromium-galaxy-s22, samsung-internet (Samsung UA
  emulation on Galaxy viewport), edge-android, plus webkit-iphone,
  chrome-ios, firefox-android, firefox-desktop — the latter four need
  libavif16 on the host (Playwright dep) but the configs are in place.

Infrastructure:
  - fixtures/test.ts central test.extend (api, db, adminToken, guest,
    host, signIn). Per-test DB truncate via the dev-only POST
    /admin/__truncate route, gated by EVENTSNAP_TEST_MODE=1.
  - helpers/sse-listener.ts, helpers/upload-client.ts (Node-side
    multipart for adversarial file-upload tests + JPEG/PNG/ELF magic
    constants), helpers/touch.ts (longPress / doubleTap / swipe /
    inlineStyle / computedStyle).
  - 10 page objects covering every route + UploadSheet/Lightbox.
  - global-setup waits for /health, logs in admin, disables every
    rate-limit and quota toggle.
  - .github/workflows/e2e.yml: PR check runs chromium-desktop + the
    smoke matrix in parallel, uploads playwright-report/ and traces on
    failure.

Findings the suite surfaces as live `[finding]` warnings (not silenced):
  1. /admin/login has no rate-limit or lockout (bcrypt cost only).
  2. PIN-attempt counter races under parallel /recover requests.
  3. Zero-byte uploads pass /api/v1/upload.
  4. SVG-with-script can pass the magic-byte check (consider CSP +
     X-Content-Type-Options on /media/*).

Stack-internal docs live in e2e/README.md (UA tier table, Samsung
Internet escalation tiers A/B/C, debugging tips, roadmap).

Final tally: 134 passed / 0 failed / 9 skipped (test.fixme stubs for
not-yet-shipped gestures and one UI-upload-flow investigation).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

e2e/page-objects/account-page.ts

@@ -0,0 +1,29 @@
+import type { Page, Locator } from '@playwright/test';
+
+export class AccountPage {
+  readonly page: Page;
+  readonly displayName: Locator;
+  readonly pinDisplay: Locator;
+  readonly leaveButton: Locator;
+  readonly leaveConfirmButton: Locator;
+  readonly privacyNote: Locator;
+
+  constructor(page: Page) {
+    this.page = page;
+    this.displayName = page.locator('[data-testid="account-display-name"]');
+    this.pinDisplay = page.locator('[data-testid="account-pin"]');
+    this.leaveButton = page.getByRole('button', { name: /event verlassen/i });
+    this.leaveConfirmButton = page.getByRole('button', { name: /^abmelden$/i });
+    this.privacyNote = page.locator('[data-testid="privacy-note"]');
+  }
+
+  async goto() {
+    await this.page.goto('/account');
+  }
+
+  async leaveEvent() {
+    await this.leaveButton.click();
+    await this.leaveConfirmButton.click();
+    await this.page.waitForURL('**/join');
+  }
+}

e2e/page-objects/admin-dashboard.ts

@@ -0,0 +1,33 @@
+import type { Page, Locator } from '@playwright/test';
+
+export class AdminDashboard {
+  readonly page: Page;
+  readonly tabStats: Locator;
+  readonly tabConfig: Locator;
+  readonly tabExport: Locator;
+  readonly tabUsers: Locator;
+  readonly userCount: Locator;
+  readonly uploadCount: Locator;
+  readonly imageSizeInput: Locator;
+  readonly videoSizeInput: Locator;
+  readonly privacyNoteTextarea: Locator;
+  readonly saveConfigButton: Locator;
+
+  constructor(page: Page) {
+    this.page = page;
+    this.tabStats = page.getByRole('button', { name: /stats/i });
+    this.tabConfig = page.getByRole('button', { name: /config/i });
+    this.tabExport = page.getByRole('button', { name: /^export$/i });
+    this.tabUsers = page.getByRole('button', { name: /nutzer/i });
+    this.userCount = page.locator('[data-testid="stat-user-count"]');
+    this.uploadCount = page.locator('[data-testid="stat-upload-count"]');
+    this.imageSizeInput = page.locator('input[name="max_image_size_mb"]');
+    this.videoSizeInput = page.locator('input[name="max_video_size_mb"]');
+    this.privacyNoteTextarea = page.locator('textarea[name="privacy_note"]');
+    this.saveConfigButton = page.getByRole('button', { name: /speichern/i }).first();
+  }
+
+  async goto() {
+    await this.page.goto('/admin');
+  }
+}

e2e/page-objects/admin-login-page.ts

@@ -0,0 +1,24 @@
+import type { Page, Locator } from '@playwright/test';
+
+export class AdminLoginPage {
+  readonly page: Page;
+  readonly passwordInput: Locator;
+  readonly submitButton: Locator;
+  readonly errorMessage: Locator;
+
+  constructor(page: Page) {
+    this.page = page;
+    this.passwordInput = page.getByTestId('admin-password-input');
+    this.submitButton = page.getByTestId('admin-login-submit');
+    this.errorMessage = page.getByTestId('admin-login-error');
+  }
+
+  async goto() {
+    await this.page.goto('/admin/login');
+  }
+
+  async login(password: string) {
+    await this.passwordInput.fill(password);
+    await this.submitButton.click();
+  }
+}

e2e/page-objects/export-page.ts

@@ -0,0 +1,21 @@
+import type { Page, Locator } from '@playwright/test';
+
+export class ExportPage {
+  readonly page: Page;
+  readonly notAvailableBanner: Locator;
+  readonly zipDownloadButton: Locator;
+  readonly htmlDownloadButton: Locator;
+  readonly htmlGuideModalContinue: Locator;
+
+  constructor(page: Page) {
+    this.page = page;
+    this.notAvailableBanner = page.locator('[data-testid="export-not-available"]');
+    this.zipDownloadButton = page.getByRole('button', { name: /zip.*herunter|herunter.*zip/i }).first();
+    this.htmlDownloadButton = page.getByRole('button', { name: /html.*herunter|herunter.*html/i }).first();
+    this.htmlGuideModalContinue = page.getByRole('button', { name: /^herunterladen$/i });
+  }
+
+  async goto() {
+    await this.page.goto('/export');
+  }
+}

e2e/page-objects/feed-page.ts

@@ -0,0 +1,47 @@
+import type { Page, Locator } from '@playwright/test';
+
+/**
+ * FeedPage — the main `/feed` route. Selectors rely on the bottom nav's
+ * aria-labels ("Galerie", "Hochladen", "Konto") and on data-testids that
+ * may be added to FeedListCard / FeedGrid later. Wherever we use a
+ * permissive locator (e.g. `.feed-card`) it is documented; tests that
+ * depend on a specific card should narrow by image alt or caption text.
+ */
+export class FeedPage {
+  readonly page: Page;
+  readonly feedTab: Locator;
+  readonly fab: Locator;
+  readonly accountTab: Locator;
+  readonly fabBadge: Locator;
+
+  constructor(page: Page) {
+    this.page = page;
+    this.feedTab = page.getByRole('link', { name: 'Galerie' });
+    this.fab = page.getByRole('button', { name: 'Hochladen' });
+    this.accountTab = page.getByRole('link', { name: 'Konto' });
+    // FAB badge — sibling span inside the FAB button.
+    this.fabBadge = this.fab.locator('span.bg-red-500');
+  }
+
+  async goto() {
+    await this.page.goto('/feed');
+  }
+
+  async openUploadSheet() {
+    await this.fab.click();
+  }
+
+  /** Locator for any feed card. Tests should refine with text or image alt. */
+  cards(): Locator {
+    return this.page.locator('[data-testid="feed-card"], article, .feed-card');
+  }
+
+  cardByCaption(text: string): Locator {
+    return this.page.locator('article', { hasText: text }).first();
+  }
+
+  /** Count of currently visible feed cards. */
+  async cardCount(): Promise<number> {
+    return this.cards().count();
+  }
+}

e2e/page-objects/host-dashboard.ts

@@ -0,0 +1,36 @@
+import type { Page, Locator } from '@playwright/test';
+
+export class HostDashboard {
+  readonly page: Page;
+  readonly statsSection: Locator;
+  readonly lockEventButton: Locator;
+  readonly unlockEventButton: Locator;
+  readonly releaseGalleryButton: Locator;
+  readonly userSearchInput: Locator;
+
+  constructor(page: Page) {
+    this.page = page;
+    this.statsSection = page.locator('[data-testid="host-stats"]');
+    this.lockEventButton = page.getByRole('button', { name: /uploads sperren|event sperren|sperren/i }).first();
+    this.unlockEventButton = page.getByRole('button', { name: /uploads freigeben|entsperren/i }).first();
+    this.releaseGalleryButton = page.getByRole('button', { name: /galerie freigeben/i });
+    this.userSearchInput = page.getByPlaceholder(/suche|search/i).first();
+  }
+
+  async goto() {
+    await this.page.goto('/host');
+  }
+
+  userRow(displayName: string): Locator {
+    return this.page.locator('tr,li,div', { hasText: displayName }).filter({ has: this.page.getByRole('button') }).first();
+  }
+
+  async banUser(displayName: string, hideUploads = false) {
+    const row = this.userRow(displayName);
+    await row.getByRole('button', { name: /sperren/i }).first().click();
+    if (hideUploads) {
+      await this.page.getByRole('checkbox', { name: /ausblenden/i }).check();
+    }
+    await this.page.getByRole('button', { name: /bestätigen|sperren/i }).last().click();
+  }
+}

e2e/page-objects/index.ts

@@ -0,0 +1,10 @@
+export { JoinPage } from './join-page';
+export { RecoverPage } from './recover-page';
+export { AdminLoginPage } from './admin-login-page';
+export { FeedPage } from './feed-page';
+export { UploadSheet } from './upload-sheet';
+export { Lightbox } from './lightbox';
+export { AccountPage } from './account-page';
+export { HostDashboard } from './host-dashboard';
+export { AdminDashboard } from './admin-dashboard';
+export { ExportPage } from './export-page';

e2e/page-objects/join-page.ts

@@ -0,0 +1,61 @@
+import type { Page, Locator } from '@playwright/test';
+
+export class JoinPage {
+  readonly page: Page;
+  readonly nameInput: Locator;
+  readonly submitButton: Locator;
+  readonly errorMessage: Locator;
+  readonly pinModal: Locator;
+  readonly pinDisplay: Locator;
+  readonly pinCopyButton: Locator;
+  readonly continueButton: Locator;
+  readonly linkToRecover: Locator;
+  // Inline recovery state (shown when the name is taken)
+  readonly recoveryPinInput: Locator;
+  readonly recoverySubmit: Locator;
+  readonly recoveryError: Locator;
+  readonly tryDifferentNameButton: Locator;
+
+  constructor(page: Page) {
+    this.page = page;
+    this.nameInput = page.getByTestId('join-name-input');
+    this.submitButton = page.getByTestId('join-submit');
+    this.errorMessage = page.getByTestId('join-error');
+    this.pinModal = page.getByTestId('pin-modal');
+    this.pinDisplay = page.getByTestId('pin-display');
+    this.pinCopyButton = page.getByTestId('pin-copy');
+    this.continueButton = page.getByTestId('continue-to-feed');
+    this.linkToRecover = page.getByTestId('link-to-recover');
+    this.recoveryPinInput = page.getByTestId('recovery-pin-input');
+    this.recoverySubmit = page.getByTestId('recovery-submit');
+    this.recoveryError = page.getByTestId('recovery-error');
+    this.tryDifferentNameButton = page.getByTestId('try-different-name');
+  }
+
+  async goto() {
+    await this.page.goto('/join');
+  }
+
+  async fillName(name: string) {
+    await this.nameInput.fill(name);
+  }
+
+  async submit() {
+    await this.submitButton.click();
+  }
+
+  /** End-to-end: type a name and submit, then either resolve when the PIN modal appears or surface the name-taken UI. */
+  async joinAs(name: string): Promise<{ pin: string }> {
+    await this.fillName(name);
+    await this.submit();
+    await this.pinModal.waitFor({ state: 'visible' });
+    const pin = (await this.pinDisplay.textContent())?.trim() ?? '';
+    return { pin };
+  }
+
+  /** Continue to the gallery after the PIN modal appears. */
+  async continueToFeed() {
+    await this.continueButton.click();
+    await this.page.waitForURL('**/feed');
+  }
+}

e2e/page-objects/lightbox.ts

@@ -0,0 +1,49 @@
+import type { Page, Locator } from '@playwright/test';
+
+export class Lightbox {
+  readonly page: Page;
+  readonly closeButton: Locator;
+  readonly nextButton: Locator;
+  readonly prevButton: Locator;
+  readonly likeButton: Locator;
+  readonly likeCount: Locator;
+  readonly commentInput: Locator;
+  readonly commentSubmit: Locator;
+  readonly commentsList: Locator;
+
+  constructor(page: Page) {
+    this.page = page;
+    this.closeButton = page.getByRole('button', { name: /schließen|close/i });
+    this.nextButton = page.getByRole('button', { name: /nächst|next/i });
+    this.prevButton = page.getByRole('button', { name: /vorherig|previous/i });
+    this.likeButton = page.getByRole('button', { name: /gefällt|like|heart/i }).first();
+    this.likeCount = page.locator('[data-testid="like-count"]').first();
+    this.commentInput = page.getByPlaceholder(/kommentar|comment/i);
+    this.commentSubmit = page.getByRole('button', { name: /senden|send|post/i }).first();
+    this.commentsList = page.locator('[data-testid="comments-list"]');
+  }
+
+  async close() {
+    await this.closeButton.click();
+  }
+
+  async like() {
+    await this.likeButton.click();
+  }
+
+  async addComment(text: string) {
+    await this.commentInput.fill(text);
+    await this.commentSubmit.click();
+  }
+
+  /** Swipe gesture support for mobile spec. */
+  async swipeLeft() {
+    const box = await this.page.locator('body').boundingBox();
+    if (!box) return;
+    const y = box.y + box.height / 2;
+    await this.page.mouse.move(box.x + box.width * 0.8, y);
+    await this.page.mouse.down();
+    await this.page.mouse.move(box.x + box.width * 0.2, y, { steps: 10 });
+    await this.page.mouse.up();
+  }
+}

e2e/page-objects/recover-page.ts

@@ -0,0 +1,27 @@
+import type { Page, Locator } from '@playwright/test';
+
+export class RecoverPage {
+  readonly page: Page;
+  readonly nameInput: Locator;
+  readonly pinInput: Locator;
+  readonly submitButton: Locator;
+  readonly errorMessage: Locator;
+
+  constructor(page: Page) {
+    this.page = page;
+    this.nameInput = page.getByTestId('recover-name-input');
+    this.pinInput = page.getByTestId('recover-pin-input');
+    this.submitButton = page.getByTestId('recover-submit');
+    this.errorMessage = page.getByTestId('recover-error');
+  }
+
+  async goto() {
+    await this.page.goto('/recover');
+  }
+
+  async recover(name: string, pin: string) {
+    await this.nameInput.fill(name);
+    await this.pinInput.fill(pin);
+    await this.submitButton.click();
+  }
+}

e2e/page-objects/upload-sheet.ts

@@ -0,0 +1,55 @@
+import type { Page, Locator } from '@playwright/test';
+
+/**
+ * UploadSheet — the bottom-sheet UploadSheet.svelte + the `/upload` preview
+ * page. Camera button is only useful on Chromium because fake-media is a
+ * Chromium-only launch flag.
+ *
+ * Note on the actual flow: tapping the FAB opens UploadSheet.svelte; tapping
+ * "Galerie" inside it opens the native file picker which sets the staged
+ * files into the pending-upload-store; the app then navigates to /upload
+ * where the user can edit the caption and submit.
+ */
+export class UploadSheet {
+  readonly page: Page;
+  readonly fileInput: Locator;
+  readonly cameraButton: Locator;
+  readonly galleryButton: Locator;
+  readonly captionInput: Locator;
+  readonly submitButton: Locator;
+
+  constructor(page: Page) {
+    this.page = page;
+    // The file input lives inside the UploadSheet bottom sheet AND inside the
+    // /upload preview page. Both work with setInputFiles. `.first()` keeps strict
+    // mode happy when both happen to exist mid-transition.
+    this.fileInput = page.locator('input[type="file"]').first();
+    this.cameraButton = page.getByRole('button', { name: /kamera/i });
+    this.galleryButton = page.getByRole('button', { name: /galerie/i });
+    this.captionInput = page.getByTestId('upload-caption');
+    this.submitButton = page.getByTestId('upload-submit');
+  }
+
+  /** Stage one or more files via the hidden file input — bypasses the native picker. */
+  async stageFiles(paths: string[]) {
+    await this.fileInput.setInputFiles(paths);
+  }
+
+  async fillCaption(caption: string) {
+    await this.captionInput.fill(caption);
+  }
+
+  async submit() {
+    await this.submitButton.click();
+  }
+
+  /** Helper: open sheet, stage one file, fill caption, submit. Returns when navigation back to feed completes. */
+  async uploadOne(page: Page, filePath: string, caption = '') {
+    await this.stageFiles([filePath]);
+    // The app may auto-navigate to /upload; wait for the caption editor to be ready.
+    await this.captionInput.waitFor({ state: 'visible', timeout: 10_000 });
+    if (caption) await this.fillCaption(caption);
+    await this.submit();
+    await page.waitForURL('**/feed', { timeout: 15_000 });
+  }
+}