feat(test): M5.3 — Playwright e2e harness for the dev stack

playwright.config.ts + tests/e2e/{apex,tenant,health}.spec.ts. make e2e for local. CI e2e job opt-in via RUN_E2E repo variable. OIDC click-through deferred to when stage is up.

Refs: M5.3

playwright.config.ts

@@ -0,0 +1,40 @@
+import { defineConfig, devices } from "@playwright/test";
+
+// Playwright e2e harness for the portal.
+//
+// Local: assumes the full dev stack is running —
+//   1. cd platform/orca-platform && make dev-up
+//   2. cd platform/tenant-registry && make dev
+//   3. cd platform/portal && make dev
+//   4. cd platform/portal && pnpm e2e
+//
+// Defaults to http://acme.localhost:3000 so subdomain routing fires.
+// Override with PLAYWRIGHT_BASE_URL for stage (once that exists, M5.x+).
+
+const baseURL = process.env.PLAYWRIGHT_BASE_URL ?? "http://acme.localhost:3000";
+const apexURL = process.env.PLAYWRIGHT_APEX_URL ?? "http://localhost:3000";
+
+export default defineConfig({
+  testDir: "./tests/e2e",
+  fullyParallel: false, // Hosts share subdomains; serial keeps logs sane.
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 1 : 0,
+  reporter: process.env.CI ? "github" : "list",
+  use: {
+    baseURL,
+    trace: "retain-on-failure",
+    screenshot: "only-on-failure",
+  },
+  projects: [
+    {
+      name: "chromium",
+      use: { ...devices["Desktop Chrome"] },
+    },
+  ],
+  // Tag-friendly: tests that need the dev stack alive use `@needs-stack`
+  // in their title so we can split fast/slow runs in CI later.
+  metadata: {
+    apexURL,
+    baseURL,
+  },
+});