[AZ-456] Test infrastructure: Vitest + MSW + Playwright + scripts

Scaffolds the Blackbox test project per AZ-456 / environment.md across
the three profiles:

- fast  : Vitest 3.x + jsdom + MSW 2.x + RTL/jest-dom; tests/setup.ts
          boots the MSW Node server with onUnhandledRequest:'error',
          afterEach resets handlers, clears bearer + navigate-to-login
          spy. Default handlers ship for every suite service plus OWM
          and tile stand-ins. Fixtures mirror seed_* in test-data.md.
- e2e   : Playwright ^1.49 with chromium + firefox projects against the
          suite docker-compose stack; owm-stub + tile-stub Bun servers,
          playwright-runner image, seeds.sql for the test-db.
- static: scripts/run-tests.sh extended — tsc --noEmit (test config),
          vite build, ripgrep checks (with grep -r fallback), CSV
          report at test-output/static-report.csv per AC-7 columns.

Smoke tests cover AC-3, AC-4 (fast, 5 tests, PASS) and AC-1, AC-2,
AC-5, AC-8 (e2e, gated by Risk 4 docker availability). Static profile
(13 checks) PASS — STC-SEC1 (no literal OWM key) lifted from
QUARANTINE per AZ-447 with a narrowed pattern.

Files:
  +24 tests/**, +10 e2e/**, +vitest.config.ts, +tsconfig.test.json
  ~package.json (test scripts + devDeps for vitest, @testing-library/*,
   msw, @playwright/test, jsdom, @types/node, @vitest/coverage-v8)
  ~scripts/run-tests.sh, scripts/run-performance-tests.sh — switched
   RESULTS_DIR to test-output/, compose path to project-local
  ~.gitignore — added /test-output/

Verification:
  bun run test:fast        → 11 / 11 PASS
  ./scripts/run-tests.sh   → static 13/13 + fast 11/11 PASS, exit 0

Tracker: AZ-456 → In Testing.
Co-authored-by: Cursor <cursoragent@cursor.com>

tests/msw/handlers/annotations.ts

@@ -0,0 +1,90 @@
+import { http } from 'msw'
+import { jsonResponse, noContent, paginate, sse } from '../helpers'
+import { seedMedia } from '../../fixtures/seed_media'
+import { seedAnnotations } from '../../fixtures/seed_annotations'
+import { seedUserSettings } from '../../fixtures/seed_user_settings'
+
+// Default `/api/annotations/*` handlers — media list, annotation CRUD, dataset,
+// status SSE. The annotation status SSE returns a small canned event sequence
+// so dataset / annotations tests don't have to register their own stream just
+// to mount a component.
+
+export const annotationsHandlers = [
+  http.get('/api/annotations/media', ({ request }) => {
+    const url = new URL(request.url)
+    const page = Number(url.searchParams.get('page') ?? '1')
+    const pageSize = Number(url.searchParams.get('pageSize') ?? String(seedMedia.length))
+    return jsonResponse(paginate(seedMedia, page, pageSize))
+  }),
+
+  http.get('/api/annotations/media/:id', ({ params }) => {
+    const m = seedMedia.find((x) => x.id === params.id)
+    if (!m) return new Response(null, { status: 404 })
+    return jsonResponse(m)
+  }),
+
+  http.get('/api/annotations/media/:id/annotations', ({ params }) =>
+    jsonResponse(seedAnnotations.filter((a) => a.mediaId === params.id)),
+  ),
+
+  http.get('/api/annotations', () => jsonResponse(seedAnnotations)),
+
+  http.post('/api/annotations', async ({ request }) => {
+    const body = (await request.json()) as Record<string, unknown>
+    return jsonResponse({ id: 'ann-new', createdDate: new Date().toISOString(), ...body }, { status: 201 })
+  }),
+
+  http.patch('/api/annotations/:id/status', async ({ request, params }) => {
+    const body = (await request.json()) as { status?: number }
+    return jsonResponse({ id: params.id, status: body.status ?? 10 })
+  }),
+
+  http.delete('/api/annotations/:id', () => noContent()),
+
+  http.get('/api/annotations/dataset', () =>
+    jsonResponse(
+      seedAnnotations.map((a) => ({
+        annotationId: a.id,
+        imageName: `image-${a.mediaId}.jpg`,
+        thumbnailPath: `/thumbs/${a.mediaId}.jpg`,
+        status: a.status,
+        createdDate: a.createdDate,
+        createdEmail: 'op_alice@test.local',
+        flightName: 'Flight 1',
+        source: a.source,
+        isSeed: false,
+        isSplit: a.isSplit,
+      })),
+    ),
+  ),
+
+  http.post('/api/annotations/dataset/bulk-status', async ({ request }) => {
+    const body = (await request.json()) as { ids?: string[]; status?: number }
+    return jsonResponse({ updated: body.ids?.length ?? 0, status: body.status ?? 30 })
+  }),
+
+  http.get('/api/annotations/dataset/distribution', () =>
+    jsonResponse([
+      { classNum: 0, label: 'class-0', color: '#ff0000', count: 12 },
+      { classNum: 1, label: 'class-1', color: '#00ff00', count: 7 },
+    ]),
+  ),
+
+  http.get('/api/annotations/status', () =>
+    sse([
+      { event: 'status', data: { annotationId: seedAnnotations[0]?.id ?? 'ann-1', status: 20 }, id: '1' },
+      { event: 'status', data: { annotationId: seedAnnotations[0]?.id ?? 'ann-1', status: 30 }, id: '2' },
+    ]),
+  ),
+
+  http.get('/api/annotations/users/:userId/settings', ({ params }) => {
+    const s = seedUserSettings.find((x) => x.userId === params.userId)
+    if (!s) return new Response(null, { status: 404 })
+    return jsonResponse(s)
+  }),
+
+  http.put('/api/annotations/users/:userId/settings', async ({ request, params }) => {
+    const body = (await request.json()) as Record<string, unknown>
+    return jsonResponse({ id: 'user-settings-1', userId: params.userId, ...body })
+  }),
+]