test(e2e): add playwright e2e harness

Process and API-only Playwright harness: binary and image setup, server/CLI runners, fake Docker Engine socket, read-only database inspection, secret redaction in reports, seeded fuzzing, leak detection and harness self-checks.

e2e/playwright.config.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (C) 2026 Bryan Joshua Pedini
+
+import { defineConfig } from '@playwright/test';
+
+/**
+ * dpsapi E2E suite (API/process only — no browsers).
+ *
+ *   npx playwright test --project=host    # compiled binary on the host ($DPSAPI_BIN, default ../dpsapi)
+ *   npx playwright test --project=image   # final container image ($DPSAPI_IMAGE)
+ *
+ * Setup projects (host-setup / image-setup) build/validate prerequisites and run automatically
+ * as dependencies. Global teardown fails the run on leaked containers/processes/workspaces.
+ */
+export default defineConfig({
+  testDir: './tests',
+  globalSetup: './harness/global-setup.ts',
+  globalTeardown: './harness/global-teardown.ts',
+  fullyParallel: true,
+  workers: Number(process.env.DPSAPI_E2E_WORKERS || 4),
+  retries: 0,
+  forbidOnly: true,
+  timeout: 60_000,
+  expect: { timeout: 10_000 },
+  reportSlowTests: null,
+  outputDir: './test-results',
+  reporter: [
+    ['./harness/redacting-reporter.ts'],
+    ['list'],
+    ['json', { outputFile: './reports/results.json' }],
+    ['html', { open: 'never', outputFolder: './reports/html' }],
+  ],
+  use: { trace: 'off' },
+  projects: [
+    { name: 'host-setup', testDir: './setup', testMatch: 'host.setup.ts' },
+    { name: 'host', testDir: './tests/host', dependencies: ['host-setup'] },
+    { name: 'image-setup', testDir: './setup', testMatch: 'image.setup.ts' },
+    { name: 'image', testDir: './tests/image', dependencies: ['image-setup'] },
+  ],
+});