[AZ-456] Test infrastructure: Vitest + MSW + Playwright + scripts

Scaffolds the Blackbox test project per AZ-456 / environment.md across
the three profiles:

- fast  : Vitest 3.x + jsdom + MSW 2.x + RTL/jest-dom; tests/setup.ts
          boots the MSW Node server with onUnhandledRequest:'error',
          afterEach resets handlers, clears bearer + navigate-to-login
          spy. Default handlers ship for every suite service plus OWM
          and tile stand-ins. Fixtures mirror seed_* in test-data.md.
- e2e   : Playwright ^1.49 with chromium + firefox projects against the
          suite docker-compose stack; owm-stub + tile-stub Bun servers,
          playwright-runner image, seeds.sql for the test-db.
- static: scripts/run-tests.sh extended — tsc --noEmit (test config),
          vite build, ripgrep checks (with grep -r fallback), CSV
          report at test-output/static-report.csv per AC-7 columns.

Smoke tests cover AC-3, AC-4 (fast, 5 tests, PASS) and AC-1, AC-2,
AC-5, AC-8 (e2e, gated by Risk 4 docker availability). Static profile
(13 checks) PASS — STC-SEC1 (no literal OWM key) lifted from
QUARANTINE per AZ-447 with a narrowed pattern.

Files:
  +24 tests/**, +10 e2e/**, +vitest.config.ts, +tsconfig.test.json
  ~package.json (test scripts + devDeps for vitest, @testing-library/*,
   msw, @playwright/test, jsdom, @types/node, @vitest/coverage-v8)
  ~scripts/run-tests.sh, scripts/run-performance-tests.sh — switched
   RESULTS_DIR to test-output/, compose path to project-local
  ~.gitignore — added /test-output/

Verification:
  bun run test:fast        → 11 / 11 PASS
  ./scripts/run-tests.sh   → static 13/13 + fast 11/11 PASS, exit 0

Tracker: AZ-456 → In Testing.
Co-authored-by: Cursor <cursoragent@cursor.com>

e2e/stubs/owm/Dockerfile

@@ -0,0 +1,10 @@
+FROM oven/bun:1.3.11-alpine
+
+WORKDIR /app
+COPY server.ts ./
+
+# wget is used by the docker-compose healthcheck.
+RUN apk add --no-cache wget
+
+EXPOSE 8081
+CMD ["bun", "run", "server.ts"]

e2e/stubs/owm/server.ts

@@ -0,0 +1,58 @@
+// owm-stub — OpenWeatherMap stand-in for the e2e profile (AZ-456 AC-2).
+// Returns canned `/data/2.5/weather` responses keyed by lat,lon. A request log
+// is exposed at `/mock/log` for resilience tests; `/mock/config` swaps the
+// canned set without restarting the container.
+
+interface WindResponse {
+  wind: { speed: number; deg: number }
+  name: string
+  coord: { lat: number; lon: number }
+}
+
+const PORT = Number(process.env.PORT ?? 8081)
+
+let cannedResponses: Record<string, WindResponse> = {
+  '0,0': { wind: { speed: 5.0, deg: 270 }, name: 'TestCity', coord: { lat: 0, lon: 0 } },
+  '50.45,30.52': { wind: { speed: 7.5, deg: 90 }, name: 'Kyiv', coord: { lat: 50.45, lon: 30.52 } },
+}
+
+const requestLog: Array<{ ts: string; method: string; url: string }> = []
+
+function key(lat: string | null, lon: string | null): string {
+  return `${lat ?? '0'},${lon ?? '0'}`
+}
+
+const server = Bun.serve({
+  port: PORT,
+  fetch(req) {
+    const url = new URL(req.url)
+    requestLog.push({ ts: new Date().toISOString(), method: req.method, url: url.pathname + url.search })
+
+    if (url.pathname === '/health') {
+      return new Response('ok', { status: 200 })
+    }
+
+    if (url.pathname === '/mock/log') {
+      return Response.json(requestLog)
+    }
+
+    if (url.pathname === '/mock/config' && req.method === 'POST') {
+      return req.json().then((body) => {
+        cannedResponses = body as Record<string, WindResponse>
+        return new Response(null, { status: 204 })
+      })
+    }
+
+    if (url.pathname === '/data/2.5/weather') {
+      const lat = url.searchParams.get('lat')
+      const lon = url.searchParams.get('lon')
+      const k = key(lat, lon)
+      const payload = cannedResponses[k] ?? cannedResponses['0,0']
+      return Response.json(payload)
+    }
+
+    return new Response('not found', { status: 404 })
+  },
+})
+
+console.log(`[owm-stub] listening on :${server.port}`)

e2e/stubs/tile/Dockerfile

@@ -0,0 +1,9 @@
+FROM oven/bun:1.3.11-alpine
+
+WORKDIR /app
+COPY server.ts ./
+
+RUN apk add --no-cache wget
+
+EXPOSE 8082
+CMD ["bun", "run", "server.ts"]

e2e/stubs/tile/server.ts

@@ -0,0 +1,43 @@
+// tile-stub — OSM + Esri tile stand-in for the e2e profile (AZ-456 AC-2).
+// Always returns a deterministic 256×256 transparent PNG. Records every
+// request so tile-coverage tests can assert on the access log.
+
+const PORT = Number(process.env.PORT ?? 8082)
+
+const TILE_PNG = new Uint8Array([
+  0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d, 0x49, 0x48, 0x44, 0x52,
+  0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x08, 0x06, 0x00, 0x00, 0x00, 0x5c, 0x72, 0xa8,
+  0x66, 0x00, 0x00, 0x00, 0x10, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9c, 0xed, 0xc1, 0x01, 0x0d, 0x00,
+  0x00, 0x00, 0xc2, 0xa0, 0xf7, 0x4f, 0x6d, 0x0e, 0x37, 0xa0, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45,
+  0x4e, 0x44, 0xae, 0x42, 0x60, 0x82,
+])
+
+const requestLog: Array<{ ts: string; method: string; url: string; scheme: 'osm' | 'esri' | 'other' }> = []
+
+function classify(pathname: string): 'osm' | 'esri' | 'other' {
+  if (/^\/sat\//.test(pathname)) return 'esri'
+  if (/^\/\d+\/\d+\/\d+\.png$/.test(pathname)) return 'osm'
+  return 'other'
+}
+
+const server = Bun.serve({
+  port: PORT,
+  fetch(req) {
+    const url = new URL(req.url)
+    const scheme = classify(url.pathname)
+    requestLog.push({ ts: new Date().toISOString(), method: req.method, url: url.pathname, scheme })
+
+    if (url.pathname === '/health') {
+      return new Response('ok', { status: 200 })
+    }
+    if (url.pathname === '/mock/log') {
+      return Response.json(requestLog)
+    }
+    if (scheme === 'osm' || scheme === 'esri') {
+      return new Response(TILE_PNG, { headers: { 'Content-Type': 'image/png' } })
+    }
+    return new Response('not found', { status: 404 })
+  },
+})
+
+console.log(`[tile-stub] listening on :${server.port}`)