test(e2e): add playwright e2e harness

Process and API-only Playwright harness: binary and image setup, server/CLI runners, fake Docker Engine socket, read-only database inspection, secret redaction in reports, seeded fuzzing, leak detection and harness self-checks.

e2e/setup/prereq.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (C) 2026 Bryan Joshua Pedini
+
+/**
+ * Prerequisite checks shared by the setup projects. Every failure is a HarnessError('prerequisite')
+ * with an actionable message, so a broken environment fails fast and is never mistaken for an
+ * application failure.
+ */
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { ALPINE_IMAGE } from '../harness/env';
+import { HarnessError } from '../harness/errors';
+
+export function sh(cmd: string, args: string[], timeoutMs = 60_000): { code: number | null; out: string; err: string } {
+  const r = spawnSync(cmd, args, { encoding: 'utf8', timeout: timeoutMs });
+  if (r.error) return { code: null, out: '', err: r.error.message };
+  return { code: r.status, out: r.stdout ?? '', err: r.stderr ?? '' };
+}
+
+export function requireTool(name: string, args: string[], hint: string): void {
+  const r = sh(name, args, 20_000);
+  if (r.code !== 0) throw new HarnessError('prerequisite', `${name} is required (${hint}): \`${name} ${args.join(' ')}\` failed: ${r.err.trim() || r.out.trim()}`);
+}
+
+export function requireDocker(): void {
+  requireTool('docker', ['version', '--format', '{{.Server.Version}}'], 'Docker Engine reachable by the current user');
+  const r = sh('docker', ['image', 'inspect', '--format', '{{.Id}}', ALPINE_IMAGE]);
+  if (r.code !== 0) throw new HarnessError('prerequisite', `test image ${ALPINE_IMAGE} is not present locally (docker pull ${ALPINE_IMAGE}): ${r.err.trim()}`);
+}
+
+export function requireCurl(): void {
+  requireTool('curl', ['--version'], 'real curl client for the HTTP tests');
+}
+
+/** Unprivileged user+mount namespaces with a bind mount over /var/run/docker.sock (fake/inaccessible Docker sockets). */
+export function requireUnshare(): void {
+  if (!fs.existsSync('/var/run/docker.sock')) throw new HarnessError('prerequisite', '/var/run/docker.sock must exist (bind-mount target for the fake Docker socket)');
+  const r = sh('unshare', ['-Urm', 'sh', '-c', 'mount --bind /etc/hostname /var/run/docker.sock && test -f /var/run/docker.sock && mount -t tmpfs none /run && test ! -e /var/run/docker.sock']);
+  if (r.code !== 0) throw new HarnessError('prerequisite', `unprivileged user/mount namespaces are required (unshare -Urm + bind mount + tmpfs): ${r.err.trim()}`);
+}