test(e2e): add playwright e2e harness

Process and API-only Playwright harness: binary and image setup, server/CLI runners, fake Docker Engine socket, read-only database inspection, secret redaction in reports, seeded fuzzing, leak detection and harness self-checks.

e2e/setup/host.setup.ts

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (C) 2026 Bryan Joshua Pedini
+
+/**
+ * `host-setup` project: build (when using the default ../dpsapi) and validate the production
+ * binary, and check every host prerequisite. All host tests depend on it.
+ */
+import fs from 'node:fs';
+import { test as setup, expect } from '@playwright/test';
+import { binaryIsDefault, binaryPath, REPO_ROOT } from '../harness/env';
+import { HarnessError } from '../harness/errors';
+import { requireCurl, requireDocker, requireUnshare, sh } from './prereq';
+
+setup('host prerequisites: tools, namespaces, Docker, production binary', async () => {
+  setup.setTimeout(300_000);
+  requireCurl();
+  requireUnshare();
+  requireDocker();
+
+  const bin = binaryPath();
+  if (binaryIsDefault() && process.env.DPSAPI_E2E_SKIP_BUILD !== '1') {
+    // PLAN §12 item 1: build the production binary used by the suite (same recipe as `make build`).
+    const r = sh('make', ['-C', REPO_ROOT, 'build'], 280_000);
+    if (r.code !== 0) throw new HarnessError('prerequisite', `make build failed (${r.code}):\n${r.out}\n${r.err}`);
+  }
+  if (!fs.existsSync(bin)) throw new HarnessError('prerequisite', `binary ${bin} does not exist (run make build or set DPSAPI_BIN)`);
+  try {
+    fs.accessSync(bin, fs.constants.X_OK);
+  } catch {
+    throw new HarnessError('prerequisite', `binary ${bin} is not executable`);
+  }
+  const head = Buffer.alloc(4);
+  const fd = fs.openSync(bin, 'r');
+  fs.readSync(fd, head, 0, 4, 0);
+  fs.closeSync(fd);
+  if (!head.equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46]))) throw new HarnessError('prerequisite', `binary ${bin} is not an ELF executable`);
+
+  // Smoke check: with an empty environment the binary must reject the configuration (exit 2).
+  const r = sh('env', ['-i', bin], 10_000);
+  if (r.code !== 2 || r.err !== 'dpsapi: configuration error: DB_PATH is required\n') {
+    throw new HarnessError('prerequisite', `binary ${bin} does not behave like dpsapi (env -i → exit ${r.code}, stderr ${JSON.stringify(r.err)})`);
+  }
+  expect(r.out).toBe('');
+});