feat(e2e): Playwright suite — 134 tests across 9 spec areas + UA matrix

Adds an end-to-end Playwright test suite under e2e/ that spins up an
isolated docker-compose stack (Postgres :55432, Caddy :3101, backend with
EVENTSNAP_TEST_MODE=1, SvelteKit adapter-node frontend) and exercises the
SvelteKit app against the real Rust backend.

Phase 1 — happy paths covering every documented USER_JOURNEYS.md flow:
  01-auth/      join, recover, admin login, leave event, PIN lockout
  02-upload/    gallery picker (API path), rate-limit + admin toggle
  03-feed/      like/comment SSE, filters, SSE reconnect on visibility
  04-host/      event lock API, ban/unban, promote
  05-admin/     config validation, foundational authz guards, stats
  06-export/    /export status + download stub
  __smoke/      cross-UA happy-path (runs on every UA project)

Phase 2 — adversarial + browser chaos:
  07-adversarial/  XSS payloads (6 × display name path), SQLi shapes,
                   length / encoding / RTL override / NUL byte;
                   file-upload boundaries (ELF body claimed as JPEG,
                   oversize vs max_image_size_mb, zero-byte, NUL
                   filename, path-traversal, SVG-with-script);
                   JWT alg:none, signature/payload tamper, expired
                   session, PIN brute-force (serial + parallel),
                   admin password brute-force; deep authz (cross-user
                   delete, banned user across like/comment/feed-read,
                   host→admin escalation); small-scale DDoS (20× /join,
                   10MB comment body, 10 concurrent SSE).
  08-browser-chaos/ localStorage / sessionStorage / cookie purge,
                    IndexedDB drop mid-session, offline → reconnect,
                    slow-3G, 503 flakes, 429 with no retry storm,
                    multi-tab same/different user, no-JS, hostile CSS,
                    clock skew ±1h / -2d, localStorage quota exhausted.

Phase 3 — mobile gestures (runs only on chromium-mobile / Pixel 7):
  09-mobile/    touch-target ≥44px audit, env(safe-area-inset-bottom)
                structural check, long-press (FeedListCard → ContextSheet,
                quick-tap negation, click-suppression), double-tap
                (feed card like + lightbox heart-burst, via synthetic
                pointer events to bypass the first-tap-fires-click trap),
                viewport reflow (portrait/landscape/narrow/phablet),
                plus fixme stubs documenting planned gestures (swipe
                lightbox L/R, swipe-down dismiss, pull-to-refresh,
                long-press-comment).

Cross-UA matrix (chromium-engine projects run @smoke only):
  chromium-pixel7, chromium-galaxy-s22, samsung-internet (Samsung UA
  emulation on Galaxy viewport), edge-android, plus webkit-iphone,
  chrome-ios, firefox-android, firefox-desktop — the latter four need
  libavif16 on the host (Playwright dep) but the configs are in place.

Infrastructure:
  - fixtures/test.ts central test.extend (api, db, adminToken, guest,
    host, signIn). Per-test DB truncate via the dev-only POST
    /admin/__truncate route, gated by EVENTSNAP_TEST_MODE=1.
  - helpers/sse-listener.ts, helpers/upload-client.ts (Node-side
    multipart for adversarial file-upload tests + JPEG/PNG/ELF magic
    constants), helpers/touch.ts (longPress / doubleTap / swipe /
    inlineStyle / computedStyle).
  - 10 page objects covering every route + UploadSheet/Lightbox.
  - global-setup waits for /health, logs in admin, disables every
    rate-limit and quota toggle.
  - .github/workflows/e2e.yml: PR check runs chromium-desktop + the
    smoke matrix in parallel, uploads playwright-report/ and traces on
    failure.

Findings the suite surfaces as live `[finding]` warnings (not silenced):
  1. /admin/login has no rate-limit or lockout (bcrypt cost only).
  2. PIN-attempt counter races under parallel /recover requests.
  3. Zero-byte uploads pass /api/v1/upload.
  4. SVG-with-script can pass the magic-byte check (consider CSP +
     X-Content-Type-Options on /media/*).

Stack-internal docs live in e2e/README.md (UA tier table, Samsung
Internet escalation tiers A/B/C, debugging tips, roadmap).

Final tally: 134 passed / 0 failed / 9 skipped (test.fixme stubs for
not-yet-shipped gestures and one UI-upload-flow investigation).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

e2e/playwright.config.ts

@@ -0,0 +1,139 @@
+import { defineConfig, devices } from '@playwright/test';
+
+/**
+ * EventSnap E2E config.
+ *
+ * Defaults assume the test stack is already up (`npm run stack:up`). The
+ * stack is *not* started by webServer because Playwright would clobber the
+ * compose volumes between retries. CI calls `npm run stack:up` once before
+ * `npm run test:e2e` runs.
+ *
+ * UA matrix: the `@smoke` happy-path runs across every project to catch
+ * engine-level divergences. The rest of the suite only runs against
+ * `chromium-desktop` to keep the wall-clock reasonable.
+ */
+export default defineConfig({
+  testDir: './specs',
+  outputDir: './test-results',
+  fullyParallel: false,            // Single shared backend → tests TRUNCATE between, so don't run in parallel.
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  workers: 1,                      // One worker. Multi-worker needs per-worker isolated DBs (Phase 2+).
+  reporter: [
+    ['list'],
+    ['html', { open: 'never', outputFolder: './playwright-report' }],
+  ],
+  globalSetup: './global-setup.ts',
+  globalTeardown: './global-teardown.ts',
+  timeout: 60_000,
+  expect: { timeout: 10_000 },
+
+  use: {
+    baseURL: process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101',
+    trace: 'retain-on-failure',
+    screenshot: 'only-on-failure',
+    video: 'retain-on-failure',
+    actionTimeout: 10_000,
+    navigationTimeout: 30_000,
+    // Camera/mic permissions granted by default; the fake-media launch args
+    // (set per-project below for Chromium) supply the actual stream.
+    permissions: ['camera', 'microphone', 'clipboard-read', 'clipboard-write'],
+  },
+
+  projects: [
+    // ── Baseline desktop ─────────────────────────────────────────────────
+    {
+      name: 'chromium-desktop',
+      // 09-mobile/ specs only run on the chromium-mobile project below — they
+      // require `hasTouch: true` and a phone viewport.
+      testIgnore: ['**/09-mobile/**'],
+      use: {
+        ...devices['Desktop Chrome'],
+        launchOptions: {
+          args: [
+            '--use-fake-ui-for-media-stream',
+            '--use-fake-device-for-media-stream',
+            // A video file would be loaded with --use-file-for-fake-video-capture
+            // — we ship a tiny .y4m in fixtures/media/ as a follow-up.
+          ],
+        },
+      },
+    },
+
+    // ── Phase 3 mobile gestures ──────────────────────────────────────────
+    // Runs ONLY the 09-mobile/ specs. Uses the Pixel 7 device descriptor so
+    // hasTouch + isMobile + mobile viewport are all set, then dispatches
+    // pointer events via page.mouse / locator helpers. Real touch events
+    // come from `page.touchscreen` when needed.
+    {
+      name: 'chromium-mobile',
+      testMatch: ['**/09-mobile/**/*.spec.ts'],
+      use: { ...devices['Pixel 7'] },
+    },
+
+    // ── Mobile UA smoke matrix (runs only @smoke specs in CI) ────────────
+    {
+      name: 'chromium-pixel7',
+      use: { ...devices['Pixel 7'] },
+      grep: /@smoke/,
+    },
+    {
+      name: 'chromium-galaxy-s22',
+      use: {
+        ...devices['Galaxy S9+'],         // Playwright doesn't ship S22 yet — S9+ is the closest Samsung descriptor.
+        viewport: { width: 360, height: 780 },
+        userAgent:
+          'Mozilla/5.0 (Linux; Android 14; SM-S911B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36',
+      },
+      grep: /@smoke/,
+    },
+    {
+      name: 'samsung-internet',
+      use: {
+        ...devices['Galaxy S9+'],
+        viewport: { width: 360, height: 780 },
+        userAgent:
+          'Mozilla/5.0 (Linux; Android 14; SM-S911B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/24.0 Chrome/124.0.0.0 Mobile Safari/537.36',
+      },
+      grep: /@smoke/,
+    },
+    {
+      name: 'edge-android',
+      use: {
+        ...devices['Pixel 7'],
+        userAgent:
+          'Mozilla/5.0 (Linux; Android 14; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36 EdgA/124.0.0.0',
+      },
+      grep: /@smoke/,
+    },
+    {
+      name: 'chrome-ios',
+      use: {
+        ...devices['iPhone 14 Pro'],
+        userAgent:
+          'Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/124.0.0.0 Mobile/15E148 Safari/604.1',
+      },
+      grep: /@smoke/,
+    },
+    {
+      name: 'webkit-iphone',
+      use: { ...devices['iPhone 14 Pro'] },
+      grep: /@smoke/,
+    },
+    {
+      name: 'firefox-android',
+      use: {
+        ...devices['Pixel 7'],
+        defaultBrowserType: 'firefox',
+        userAgent:
+          'Mozilla/5.0 (Android 14; Mobile; rv:124.0) Gecko/124.0 Firefox/124.0',
+      },
+      grep: /@smoke/,
+    },
+    {
+      name: 'firefox-desktop',
+      use: { ...devices['Desktop Firefox'] },
+      grep: /@smoke/,
+    },
+  ],
+});