ci: run Playwright e2e tests on every PR

[GirlBossRush]

Context

Today the only end-to-end coverage that runs on each PR in GitHub Actions is the Django/Selenium suite under tests/e2e/. The browser-side Playwright suite under web/e2e/ (driven by web/playwright.config.js) is run locally by frontend developers — it never executes on CI. That gap means UI regressions only surface during manual review or after merge.

Problem

• Frontend changes can land without any automated browser verification.
• Reviewers and release managers cannot trust that a green CI implies a working web UI.
• Local-only execution drifts: tests rot, fixtures break silently, and the bar to run them goes up over time.

Proposal

Wire up the existing Playwright suite to run on every PR via GitHub Actions. Concretely:

• Add a ci-web-e2e job (or extend ci-web.yml) that:
  • Boots an authentik stack sufficient for the current Playwright fixtures (auth flows, providers, sessions).
  • Installs Playwright browsers via corepack-pinned npm.
  • Runs npm run -w web playwright against that stack.
  • Uploads the HTML report and any traces/videos as artifacts on failure.
• Decide on a sharding/parallelism story so the job stays under a sensible wall-clock budget.
• Make the job required for merge once it is stable.

Dependencies

• Builds on top of the Corepack normalization in ci: Consistent NPM versions via Corepack #20400 — Playwright install is sensitive to npm version drift, and the e2e job will use the same composite setup-node action.
• Branch github-ci-playwright-e2e already carries WIP scaffolding on top of npm-corepack.
• Related earlier WIP: web: WIP Playwright  #15693 (Playwright groundwork).

Acceptance criteria

• Playwright e2e job runs on every PR touching web/** (and on main).
• Job is reproducible from a fresh clone — no hidden local state, no manual playwright install step in dev docs that CI skips.
• HTML report + traces are retrievable from the failed run's artifacts.
• Job is required for merge.
• Frontend developer docs are updated to point at the same npm scripts CI uses, so local and CI runs stay in lockstep.

Out of scope

• Adding new Playwright tests beyond what's needed to validate the CI plumbing.
• Replacing the Django/Selenium suite — both stay until coverage parity is reached.