[AZ-456] Test infrastructure: Vitest + MSW + Playwright + scripts

Scaffolds the Blackbox test project per AZ-456 / environment.md across
the three profiles:

- fast  : Vitest 3.x + jsdom + MSW 2.x + RTL/jest-dom; tests/setup.ts
          boots the MSW Node server with onUnhandledRequest:'error',
          afterEach resets handlers, clears bearer + navigate-to-login
          spy. Default handlers ship for every suite service plus OWM
          and tile stand-ins. Fixtures mirror seed_* in test-data.md.
- e2e   : Playwright ^1.49 with chromium + firefox projects against the
          suite docker-compose stack; owm-stub + tile-stub Bun servers,
          playwright-runner image, seeds.sql for the test-db.
- static: scripts/run-tests.sh extended — tsc --noEmit (test config),
          vite build, ripgrep checks (with grep -r fallback), CSV
          report at test-output/static-report.csv per AC-7 columns.

Smoke tests cover AC-3, AC-4 (fast, 5 tests, PASS) and AC-1, AC-2,
AC-5, AC-8 (e2e, gated by Risk 4 docker availability). Static profile
(13 checks) PASS — STC-SEC1 (no literal OWM key) lifted from
QUARANTINE per AZ-447 with a narrowed pattern.

Files:
  +24 tests/**, +10 e2e/**, +vitest.config.ts, +tsconfig.test.json
  ~package.json (test scripts + devDeps for vitest, @testing-library/*,
   msw, @playwright/test, jsdom, @types/node, @vitest/coverage-v8)
  ~scripts/run-tests.sh, scripts/run-performance-tests.sh — switched
   RESULTS_DIR to test-output/, compose path to project-local
  ~.gitignore — added /test-output/

Verification:
  bun run test:fast        → 11 / 11 PASS
  ./scripts/run-tests.sh   → static 13/13 + fast 11/11 PASS, exit 0

Tracker: AZ-456 → In Testing.
Co-authored-by: Cursor <cursoragent@cursor.com>

e2e/stubs/tile/server.ts

@@ -0,0 +1,43 @@
+// tile-stub — OSM + Esri tile stand-in for the e2e profile (AZ-456 AC-2).
+// Always returns a deterministic 256×256 transparent PNG. Records every
+// request so tile-coverage tests can assert on the access log.
+
+const PORT = Number(process.env.PORT ?? 8082)
+
+const TILE_PNG = new Uint8Array([
+  0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d, 0x49, 0x48, 0x44, 0x52,
+  0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x08, 0x06, 0x00, 0x00, 0x00, 0x5c, 0x72, 0xa8,
+  0x66, 0x00, 0x00, 0x00, 0x10, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9c, 0xed, 0xc1, 0x01, 0x0d, 0x00,
+  0x00, 0x00, 0xc2, 0xa0, 0xf7, 0x4f, 0x6d, 0x0e, 0x37, 0xa0, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45,
+  0x4e, 0x44, 0xae, 0x42, 0x60, 0x82,
+])
+
+const requestLog: Array<{ ts: string; method: string; url: string; scheme: 'osm' | 'esri' | 'other' }> = []
+
+function classify(pathname: string): 'osm' | 'esri' | 'other' {
+  if (/^\/sat\//.test(pathname)) return 'esri'
+  if (/^\/\d+\/\d+\/\d+\.png$/.test(pathname)) return 'osm'
+  return 'other'
+}
+
+const server = Bun.serve({
+  port: PORT,
+  fetch(req) {
+    const url = new URL(req.url)
+    const scheme = classify(url.pathname)
+    requestLog.push({ ts: new Date().toISOString(), method: req.method, url: url.pathname, scheme })
+
+    if (url.pathname === '/health') {
+      return new Response('ok', { status: 200 })
+    }
+    if (url.pathname === '/mock/log') {
+      return Response.json(requestLog)
+    }
+    if (scheme === 'osm' || scheme === 'esri') {
+      return new Response(TILE_PNG, { headers: { 'Content-Type': 'image/png' } })
+    }
+    return new Response('not found', { status: 404 })
+  },
+})
+
+console.log(`[tile-stub] listening on :${server.port}`)