[AZ-456] Test infrastructure: Vitest + MSW + Playwright + scripts

Scaffolds the Blackbox test project per AZ-456 / environment.md across
the three profiles:

- fast  : Vitest 3.x + jsdom + MSW 2.x + RTL/jest-dom; tests/setup.ts
          boots the MSW Node server with onUnhandledRequest:'error',
          afterEach resets handlers, clears bearer + navigate-to-login
          spy. Default handlers ship for every suite service plus OWM
          and tile stand-ins. Fixtures mirror seed_* in test-data.md.
- e2e   : Playwright ^1.49 with chromium + firefox projects against the
          suite docker-compose stack; owm-stub + tile-stub Bun servers,
          playwright-runner image, seeds.sql for the test-db.
- static: scripts/run-tests.sh extended — tsc --noEmit (test config),
          vite build, ripgrep checks (with grep -r fallback), CSV
          report at test-output/static-report.csv per AC-7 columns.

Smoke tests cover AC-3, AC-4 (fast, 5 tests, PASS) and AC-1, AC-2,
AC-5, AC-8 (e2e, gated by Risk 4 docker availability). Static profile
(13 checks) PASS — STC-SEC1 (no literal OWM key) lifted from
QUARANTINE per AZ-447 with a narrowed pattern.

Files:
  +24 tests/**, +10 e2e/**, +vitest.config.ts, +tsconfig.test.json
  ~package.json (test scripts + devDeps for vitest, @testing-library/*,
   msw, @playwright/test, jsdom, @types/node, @vitest/coverage-v8)
  ~scripts/run-tests.sh, scripts/run-performance-tests.sh — switched
   RESULTS_DIR to test-output/, compose path to project-local
  ~.gitignore — added /test-output/

Verification:
  bun run test:fast        → 11 / 11 PASS
  ./scripts/run-tests.sh   → static 13/13 + fast 11/11 PASS, exit 0

Tracker: AZ-456 → In Testing.
Co-authored-by: Cursor <cursoragent@cursor.com>

tests/msw/handlers/admin.ts

@@ -0,0 +1,79 @@
+import { http } from 'msw'
+import { jsonResponse, noContent, paginate } from '../helpers'
+import { seedUsers, opAlice } from '../../fixtures/seed_users'
+import { seedClasses } from '../../fixtures/seed_classes'
+
+// Default `/api/admin/*` handlers — auth round-trip, users, classes-write,
+// system settings. Tests override per-scenario via `server.use(...)`.
+
+const SEED_BEARER = 'test-bearer-default'
+
+export const adminHandlers = [
+  http.post('/api/admin/auth/login', async ({ request }) => {
+    const body = (await request.json().catch(() => ({}))) as { email?: string; password?: string }
+    const user = seedUsers.find((u) => u.email === body.email) ?? opAlice
+    return new Response(JSON.stringify({ token: SEED_BEARER, user }), {
+      status: 200,
+      headers: {
+        'Content-Type': 'application/json',
+        // AC-03 contract — refresh cookie is HttpOnly + Secure + SameSite=Strict.
+        'Set-Cookie': 'refreshToken=test-refresh; HttpOnly; Secure; SameSite=Strict; Path=/api/admin/auth',
+      },
+    })
+  }),
+
+  http.post('/api/admin/auth/refresh', () => {
+    return jsonResponse({ token: SEED_BEARER })
+  }),
+
+  http.post('/api/admin/auth/logout', () => noContent()),
+
+  http.get('/api/admin/users/me', () => jsonResponse(opAlice)),
+
+  http.get('/api/admin/users', () => jsonResponse(paginate(seedUsers))),
+
+  http.get('/api/admin/users/:id', ({ params }) => {
+    const user = seedUsers.find((u) => u.id === params.id)
+    if (!user) return new Response(null, { status: 404 })
+    return jsonResponse(user)
+  }),
+
+  http.get('/api/admin/classes', () => jsonResponse(seedClasses)),
+
+  http.post('/api/admin/classes', async ({ request }) => {
+    const body = await request.json()
+    return jsonResponse(body, { status: 201 })
+  }),
+
+  http.put('/api/admin/classes/:id', async ({ request }) => {
+    const body = await request.json()
+    return jsonResponse(body)
+  }),
+
+  http.delete('/api/admin/classes/:id', () => noContent()),
+
+  http.get('/api/admin/settings', () =>
+    jsonResponse({
+      id: 'sys-settings-1',
+      name: 'Test System',
+      militaryUnit: null,
+      defaultCameraWidth: 1920,
+      defaultCameraFoV: 60,
+      thumbnailWidth: 256,
+      thumbnailHeight: 256,
+      thumbnailBorder: 2,
+      generateAnnotatedImage: true,
+      silentDetection: false,
+    }),
+  ),
+
+  http.put('/api/admin/settings', async ({ request }) => {
+    const body = await request.json()
+    return jsonResponse(body)
+  }),
+
+  // Test-only suite endpoint — gated behind a non-production build flag in the
+  // real `admin/` service. The fast-profile MSW just returns 204 so isolation
+  // helpers can call it uniformly with the e2e profile.
+  http.post('/api/admin/test-only/reset', () => noContent()),
+]