test(e2e): add playwright e2e harness

Process and API-only Playwright harness: binary and image setup, server/CLI runners, fake Docker Engine socket, read-only database inspection, secret redaction in reports, seeded fuzzing, leak detection and harness self-checks.

e2e/harness/index.ts

@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (C) 2026 Bryan Joshua Pedini
+
+/**
+ * Public entry point of the dpsapi E2E harness. Spec files import everything from here:
+ *
+ *   import { test, expect, expectCliFailure, assertDbInvariants } from '../../harness';
+ */
+export { test, expect, FuzzRecorder, type E2EContext, type E2EFixtures, type E2EOptions } from './fixtures';
+export { HarnessError, isHarnessError, type HarnessErrorKind } from './errors';
+export {
+  ALPINE_IMAGE,
+  DEFAULT_SEED,
+  E2E_ROOT,
+  LABEL_RUN,
+  LABEL_TEST,
+  PROC_MARKER_ENV,
+  REPO_ROOT,
+  RESOURCE_PREFIX,
+  binaryPath,
+  globalSeed,
+  imageRef,
+  runId,
+} from './env';
+export { DEFAULT_PROCESS_TIMEOUT_MS, mapLimit, pollUntil, runProcess, sleep, toolEnv, type ProcResult, type RunProcessOptions } from './proc';
+export {
+  AUDIT_COLUMNS,
+  CliRunner,
+  EMPTY_AUDIT,
+  EMPTY_TOKEN_LIST,
+  TOKEN_LIST_COLUMNS,
+  USAGE_ERROR_MESSAGES,
+  USAGE_TEXT,
+  baseAppEnv,
+  errorMessage,
+  expectCliFailure,
+  expectCliSuccess,
+  expectExitedNormally,
+  formatAuditOutput,
+  formatTokenList,
+  mergeEnv,
+  padTable,
+  parseAuditOutput,
+  parseTokenList,
+  printsTokens,
+  runeLength,
+  type AuditRow,
+  type TokenListEntry,
+  type CliFailureExpectation,
+  type CliOptions,
+  type CliResult,
+  type CliSuccessExpectation,
+  type TokenListRow,
+} from './cli';
+export { ServerHandle, type DockerBackend, type ExitResult, type StartServerOptions } from './server';
+export { FakeDocker, makeContainerSummaries, makeContainerSummary, type ContainerSummary, type FakeDockerMode, type FakeDockerRequest, type FakeDockerStats } from './fake-docker';
+export {
+  HttpClient,
+  bearer,
+  buildRawRequest,
+  hostPortOf,
+  parseHttpResponses,
+  rawHttp,
+  runCurl,
+  type CurlOptions,
+  type CurlResult,
+  type HeaderEntry,
+  type HttpRequestOptions,
+  type HttpResult,
+  type RawHttpOptions,
+  type RawHttpResponse,
+  type RawOutcome,
+  type RawResult,
+} from './http';
+export { RealDocker, dockerCli, listByLabel, type DockerCliOptions, type OwnContainer, type RunContainerOptions, type TestContainer } from './docker';
+export { ImageContainer, ImageRunner, snapshotDataDir, type ContainerExit, type ImageDockerBackend, type ImageExecOptions, type ImageStartOptions } from './image';
+export {
+  EXPECTED_COLUMNS,
+  RFC3339NANO_UTC_RE,
+  assertDbInvariants,
+  countRows,
+  dbSnapshot,
+  fileDigest,
+  msToNanos,
+  readOperations,
+  readSchema,
+  readToken,
+  readTokens,
+  rfc3339ToNanos,
+  withDb,
+  type DbInvariantOptions,
+  type DbInvariantReport,
+  type DbSchemaInfo,
+  type OperationRow,
+  type TokenRow,
+} from './db';
+export { SecretRegistry, TOKEN_CANDIDATE_RE, TOKEN_RE, redactText, redactValue, tokenId } from './secrets';
+export { LOG_LEVELS, LOG_TIME_RE, LogSet, levelRank, parseLogLine, parseLogs, visibleLevels, type LogLevel, type LogQuery, type LogRecord } from './logs';
+export { goQuote, goUnquote, goUnquoteBytes, shellQuote } from './gostrings';
+export { Rng, testSeed } from './rng';
+export { Recorder, jsonSafe, safeStringify, type CliRecord, type HttpRecord } from './recorder';
+export { Workspace, allocatePort, forceRemoveDir, isPortFree, occupyPort } from './workspace';
+export {
+  ERROR_BODIES,
+  INTERNAL_DETAIL_MARKERS,
+  expectContainersResponse,
+  expectErrorResponse,
+  expectNoInternalDetails,
+  view,
+  type AppErrorStatus,
+  type ResponseView,
+} from './assertions';