feat(test): M5.3 — Playwright e2e harness for the dev stack

playwright.config.ts + tests/e2e/{apex,tenant,health}.spec.ts. make e2e for local. CI e2e job opt-in via RUN_E2E repo variable. OIDC click-through deferred to when stage is up.

Refs: M5.3

.gitea/workflows/ci.yaml

@@ -87,7 +87,11 @@ jobs:
   e2e:
     needs: test
     runs-on: docker
-    if: hashFiles('playwright.config.ts','playwright.config.js') != '' && github.event_name == 'push' && github.ref == 'refs/heads/main'
+    # Two gates: playwright.config.ts must exist + the repo variable
+    # RUN_E2E must be 'true'. Until stage.breakpilot.com is up (M1.2 +
+    # M0.3), the e2e job is opt-in. Locally, devs run `make e2e` against
+    # their own dev stack.
+    if: hashFiles('playwright.config.ts','playwright.config.js') != '' && github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.RUN_E2E == 'true'
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -98,7 +102,8 @@ jobs:
       - run: pnpm exec playwright install --with-deps chromium
       - run: pnpm e2e
         env:
-          PLAYWRIGHT_BASE_URL: https://stage.breakpilot.com
+          PLAYWRIGHT_BASE_URL: ${{ vars.STAGE_PORTAL_BASE_URL }}
+          PLAYWRIGHT_APEX_URL: ${{ vars.STAGE_PORTAL_APEX_URL }}
           PLAYWRIGHT_TEST_USER: ${{ secrets.STAGE_TEST_USER }}
           PLAYWRIGHT_TEST_PASS: ${{ secrets.STAGE_TEST_PASS }}