test(e2e): add playwright e2e harness

Process and API-only Playwright harness: binary and image setup, server/CLI runners, fake Docker Engine socket, read-only database inspection, secret redaction in reports, seeded fuzzing, leak detection and harness self-checks.

e2e/harness/env.ts

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (C) 2026 Bryan Joshua Pedini
+
+/**
+ * Run-level constants and environment resolution shared by the runner process,
+ * global setup/teardown and every worker.
+ */
+import path from 'node:path';
+import { HarnessError } from './errors';
+
+/** Directory containing playwright.config.ts. */
+export const E2E_ROOT = path.resolve(__dirname, '..');
+/** Repository root (parent of e2e/). */
+export const REPO_ROOT = path.resolve(E2E_ROOT, '..');
+
+/** Every Docker resource / temp directory created by the suite starts with this. */
+export const RESOURCE_PREFIX = 'dpsapi-e2e-';
+/** Docker label carrying the run id on every resource the suite creates. */
+export const LABEL_RUN = 'dpsapi.e2e';
+/** Docker label carrying the per-test key on every resource the suite creates. */
+export const LABEL_TEST = 'dpsapi.e2e.test';
+/**
+ * Environment variable set (to the run id) on every process the harness spawns.
+ * Global teardown scans /proc/<pid>/environ for it to find leaked processes.
+ * It is deliberately NOT present in the runner/worker environment.
+ */
+export const PROC_MARKER_ENV = 'DPSAPI_E2E_PROC';
+
+/** Image used for throwaway/test containers. Must already be present locally. */
+export const ALPINE_IMAGE = process.env.DPSAPI_E2E_ALPINE || 'alpine:3.22';
+
+/** Fixed default seed used when DPSAPI_E2E_SEED is not set. */
+export const DEFAULT_SEED = 'dpsapi-e2e-default-seed-1';
+
+/**
+ * Absolute path of the binary under test: $DPSAPI_BIN (relative paths are resolved
+ * against the e2e/ directory) or ../dpsapi.
+ */
+export function binaryPath(): string {
+  return path.resolve(E2E_ROOT, process.env.DPSAPI_BIN || '../dpsapi');
+}
+
+/** True when DPSAPI_BIN was not given, i.e. the suite owns building ../dpsapi. */
+export function binaryIsDefault(): boolean {
+  return !process.env.DPSAPI_BIN;
+}
+
+/** Image reference under test ($DPSAPI_IMAGE), or undefined. */
+export function imageRef(): string | undefined {
+  return process.env.DPSAPI_IMAGE || undefined;
+}
+
+/** Run id assigned by global setup (short, [a-z0-9]). */
+export function runId(): string {
+  const id = process.env.DPSAPI_E2E_RUN_ID;
+  if (!id) throw new HarnessError('infrastructure', 'DPSAPI_E2E_RUN_ID is not set: global setup did not run');
+  return id;
+}
+
+/** Per-run scratch root (workspaces, secret registry files). Created by global setup. */
+export function runDir(): string {
+  const dir = process.env.DPSAPI_E2E_RUN_DIR;
+  if (!dir) throw new HarnessError('infrastructure', 'DPSAPI_E2E_RUN_DIR is not set: global setup did not run');
+  return dir;
+}
+
+/** Directory holding all per-test workspaces of this run. */
+export function workspacesDir(): string {
+  return path.join(runDir(), 'ws');
+}
+
+/** Directory holding per-test secret registries (read by the redacting reporter). */
+export function secretsDir(): string {
+  return path.join(runDir(), 'secrets');
+}
+
+/** Global PRNG seed: $DPSAPI_E2E_SEED or DEFAULT_SEED. */
+export function globalSeed(): string {
+  return process.env.DPSAPI_E2E_SEED || DEFAULT_SEED;
+}