build(web): add project-local Playwright tooling

- build: pin Playwright Test and MCP with repository-local npm, browser, and artifact paths plus sandboxed headless Chromium configuration.
- test: add a browser smoke test for the login page while keeping Playwright isolated from Vitest.
- docs: document Debian dependency setup, dual Chromium revisions, E2E commands, and project-scoped Codex MCP usage.

web/playwright.config.ts

@@ -0,0 +1,44 @@
+import { defineConfig, devices } from '@playwright/test'
+import { fileURLToPath } from 'node:url'
+
+const repositoryRoot = fileURLToPath(new URL('..', import.meta.url))
+
+export default defineConfig({
+  testDir: './e2e',
+  outputDir: `${repositoryRoot}/.artifacts/playwright/test-results`,
+  fullyParallel: true,
+  forbidOnly: Boolean(process.env.CI),
+  retries: process.env.CI ? 2 : 0,
+  workers: process.env.CI ? 1 : undefined,
+  reporter: [
+    ['list'],
+    [
+      'html',
+      {
+        open: 'never',
+        outputFolder: `${repositoryRoot}/.artifacts/playwright/report`,
+      },
+    ],
+  ],
+  use: {
+    baseURL: 'http://127.0.0.1:5173',
+    launchOptions: {
+      chromiumSandbox: true,
+    },
+    screenshot: 'only-on-failure',
+    trace: 'retain-on-failure',
+    video: 'retain-on-failure',
+  },
+  projects: [
+    {
+      name: 'chromium',
+      use: { ...devices['Desktop Chrome'] },
+    },
+  ],
+  webServer: {
+    command: 'npm run dev -- --host 127.0.0.1',
+    url: 'http://127.0.0.1:5173/login',
+    reuseExistingServer: !process.env.CI,
+    timeout: 120_000,
+  },
+})