Move the browser suites into the repository

They lived in a scratch directory under /tmp, which was cleared overnight;
four of the five were simply gone. Whatever they were worth, they were
worth nothing kept there.

Rewritten against a shared lib.mjs. The old ones registered their users
through the sign-up form, which no longer exists — each suite now creates
a throwaway account through the admin API and deletes it afterwards, so a
run leaves the database as it found it. The previous generation left nine
accounts behind; those are gone too.

Three test hooks went into the app, each of which earns its place beyond
testing: aria-label on the note title (the sidebar search box is also a
text input, and a screen reader could not tell them apart either),
data-note-row on list rows, data-user on admin rows.

Two suites were flaky in ways worth naming, because both were the test
misreading the app rather than the app misbehaving:
- ticking a task then inserting a note link put the link inside the task
  list, since Control+End lands there. Verified against the server that
  the tick itself persists correctly; the suite now leaves the list first
  and asserts where the link ended up.
- the note-title lookup matched the sidebar's Trash entry, which wears the
  same emoji as a note row.

56 checks across five suites, all passing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

e2e/run.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Runs the browser suites against a running InkNote.
+#
+#   ./e2e/run.sh                 # all suites
+#   ./e2e/run.sh editor drawing  # only these
+#
+# Needs the dev stack up (docker compose -f docker-compose.dev.yml up -d) and an
+# admin account to create throwaway users with — marc/geheim123 by default,
+# override with INKNOTE_ADMIN / INKNOTE_ADMIN_PASS.
+set -uo pipefail
+cd "$(dirname "$0")"
+
+IMAGE="mcr.microsoft.com/playwright:v1.49.0-noble"
+URL="${INKNOTE_URL:-http://localhost:3000}"
+SUITES=("$@")
+[ ${#SUITES[@]} -eq 0 ] && SUITES=(admin editor search-attachments history drawing)
+
+mkdir -p shots
+if [ ! -d node_modules ]; then
+  echo "→ installing playwright once"
+  docker run --rm -v "$PWD:/w" -w /w "$IMAGE" npm install --no-audit --no-fund >/dev/null
+fi
+
+if ! curl -sf -o /dev/null "$URL"; then
+  echo "✗ $URL is not answering — start the stack first:"
+  echo "    docker compose -f docker-compose.dev.yml up -d --build"
+  exit 1
+fi
+
+failed=()
+for s in "${SUITES[@]}"; do
+  echo
+  echo "═══ $s ═══"
+  docker run --rm --network host \
+    -v "$PWD:/w" -v "$PWD/shots:/out" -w /w \
+    -e INKNOTE_URL="$URL" \
+    -e INKNOTE_ADMIN="${INKNOTE_ADMIN:-marc}" \
+    -e INKNOTE_ADMIN_PASS="${INKNOTE_ADMIN_PASS:-geheim123}" \
+    "$IMAGE" node "$s.mjs" || failed+=("$s")
+done
+
+echo
+if [ ${#failed[@]} -eq 0 ]; then
+  echo "═══ all suites passed ═══"
+else
+  echo "═══ FAILED: ${failed[*]} ═══"
+  exit 1
+fi