build(web): add project-local Playwright tooling

- build: pin Playwright Test and MCP with repository-local npm, browser, and artifact paths plus sandboxed headless Chromium configuration.
- test: add a browser smoke test for the login page while keeping Playwright isolated from Vitest.
- docs: document Debian dependency setup, dual Chromium revisions, E2E commands, and project-scoped Codex MCP usage.

docs/web/decisions.md

@@ -43,3 +43,29 @@ account, admin, or large-transfer designs.
   transfer policy in MyGO code.
 - Handwritten TypeScript wire types remain temporary until an OpenAPI contract
   is available.
+
+## 2026-07-14: Project-local Headless Browser Tooling
+
+**Context**: Browser behavior needs deterministic E2E coverage and interactive
+agent debugging inside a long-lived headless Debian Incus container. Tooling
+should remain reproducible without placing browser binaries or generated
+artifacts in a developer's home directory.
+
+**Decisions**:
+
+| Area | Choice | Guidance |
+|------|--------|----------|
+| Regression tests | Playwright Test with bundled Chromium | Keep browser E2E tests separate from `npm run check` because browser installation is an explicit environment setup step. |
+| Agent debugging | Official Playwright MCP over project-scoped STDIO | Codex starts the locked local package from `.codex/config.toml`; do not use a global install, an `@latest` npx invocation, or a listening MCP service. |
+| Browser state | Headless, isolated, and sandboxed | Use bundled Chromium, discard the MCP profile after each session, and retain the Chromium sandbox supported by the Incus environment. |
+| Local resources | Repository `.cache/` and `.artifacts/` directories | `mise.toml` defines the portable npm and browser cache paths. Generated resources remain ignored by Git. |
+| Browser versions | Install both locked Playwright revisions | The stable test runner and current MCP package require different Chromium revisions; do not force either package onto an unsupported executable. |
+
+**Consequences**:
+- Debian browser libraries are installed once in the Incus container root
+  filesystem; npm packages, browsers, traces, screenshots, and MCP output stay
+  project-scoped.
+- A fresh environment runs `npm ci`, the system dependency installer, and both
+  browser install scripts before browser tests or MCP debugging.
+- Browser failures can retain traces, screenshots, and video under
+  `.artifacts/playwright/` without adding generated files to source control.