build(web): add project-local Playwright tooling

- build: pin Playwright Test and MCP with repository-local npm, browser, and artifact paths plus sandboxed headless Chromium configuration.
- test: add a browser smoke test for the login page while keeping Playwright isolated from Vitest.
- docs: document Debian dependency setup, dual Chromium revisions, E2E commands, and project-scoped Codex MCP usage.

web/README.md

@@ -36,12 +36,48 @@ Vite proxies `/api` to `http://127.0.0.1:10086`. Production deployments must
 serve the static build and `/api/v1` from the same origin, normally through a
 reverse proxy.
 
+## Browser Testing and Debugging
+
+The repository uses Playwright Test for repeatable browser tests and the
+official Playwright MCP server for interactive browser debugging. Mise keeps
+the npm cache and Playwright browser binaries under the repository-level
+`.cache/` directory.
+
+Install the Debian browser dependencies once per development container:
+
+```bash
+mise exec -- npm run playwright:install:deps
+```
+
+Install the Chromium revisions used by Playwright Test and Playwright MCP:
+
+```bash
+mise exec -- npm run playwright:install
+mise exec -- npm run playwright:install:mcp
+```
+
+The two commands are intentionally separate because the locked stable test
+runner and MCP package currently depend on different Playwright revisions.
+Both revisions are stored in `.cache/ms-playwright/` and are ignored by Git.
+
+Run the headless browser tests with Chromium sandboxing enabled:
+
+```bash
+mise exec -- npm run test:e2e
+```
+
+Codex loads the project-scoped Playwright MCP server from
+`.codex/config.toml` after the repository is trusted and Codex is restarted.
+The MCP browser uses bundled Chromium in headless, isolated, sandboxed mode;
+its generated files are kept under `.artifacts/playwright-mcp/`.
+
 ## Checks
 
 ```bash
 mise exec -- npm run check
 ```
 
-The production build is emitted to `dist/` as static assets. See
+The production build is emitted to `dist/` as static assets. Browser E2E tests
+are run separately because they require the browser setup above. See
 `docs/web/roadmap.md` at the repository root for architecture boundaries and
 planned dependencies.