[AZ-456] Test infrastructure: Vitest + MSW + Playwright + scripts

Scaffolds the Blackbox test project per AZ-456 / environment.md across
the three profiles:

- fast  : Vitest 3.x + jsdom + MSW 2.x + RTL/jest-dom; tests/setup.ts
          boots the MSW Node server with onUnhandledRequest:'error',
          afterEach resets handlers, clears bearer + navigate-to-login
          spy. Default handlers ship for every suite service plus OWM
          and tile stand-ins. Fixtures mirror seed_* in test-data.md.
- e2e   : Playwright ^1.49 with chromium + firefox projects against the
          suite docker-compose stack; owm-stub + tile-stub Bun servers,
          playwright-runner image, seeds.sql for the test-db.
- static: scripts/run-tests.sh extended — tsc --noEmit (test config),
          vite build, ripgrep checks (with grep -r fallback), CSV
          report at test-output/static-report.csv per AC-7 columns.

Smoke tests cover AC-3, AC-4 (fast, 5 tests, PASS) and AC-1, AC-2,
AC-5, AC-8 (e2e, gated by Risk 4 docker availability). Static profile
(13 checks) PASS — STC-SEC1 (no literal OWM key) lifted from
QUARANTINE per AZ-447 with a narrowed pattern.

Files:
  +24 tests/**, +10 e2e/**, +vitest.config.ts, +tsconfig.test.json
  ~package.json (test scripts + devDeps for vitest, @testing-library/*,
   msw, @playwright/test, jsdom, @types/node, @vitest/coverage-v8)
  ~scripts/run-tests.sh, scripts/run-performance-tests.sh — switched
   RESULTS_DIR to test-output/, compose path to project-local
  ~.gitignore — added /test-output/

Verification:
  bun run test:fast        → 11 / 11 PASS
  ./scripts/run-tests.sh   → static 13/13 + fast 11/11 PASS, exit 0

Tracker: AZ-456 → In Testing.
Co-authored-by: Cursor <cursoragent@cursor.com>

tests/msw/handlers/flights.ts

@@ -0,0 +1,63 @@
+import { http } from 'msw'
+import { jsonResponse, noContent, sse } from '../helpers'
+import { seedFlights } from '../../fixtures/seed_flights'
+import { seedAircraft } from '../../fixtures/seed_aircraft'
+
+// Default `/api/flights/*` handlers. Live-GPS SSE returns a deterministic
+// 3-event stream so AC-08 timing assertions have something to drive even
+// without per-test overrides.
+
+export const flightsHandlers = [
+  http.get('/api/flights', () => jsonResponse(seedFlights)),
+
+  http.get('/api/flights/:id', ({ params }) => {
+    const flight = seedFlights.find((f) => f.id === params.id)
+    if (!flight) return new Response(null, { status: 404 })
+    return jsonResponse(flight)
+  }),
+
+  http.post('/api/flights', async ({ request }) => {
+    const body = (await request.json()) as Record<string, unknown>
+    return jsonResponse({ id: 'flight-new', createdDate: new Date().toISOString(), ...body }, { status: 201 })
+  }),
+
+  http.put('/api/flights/:id', async ({ request, params }) => {
+    const body = (await request.json()) as Record<string, unknown>
+    return jsonResponse({ id: params.id, ...body })
+  }),
+
+  http.delete('/api/flights/:id', () => noContent()),
+
+  http.get('/api/flights/:id/waypoints', ({ params }) =>
+    jsonResponse([
+      {
+        id: 'wp-1',
+        flightId: params.id,
+        name: 'WP1',
+        latitude: 50.45,
+        longitude: 30.52,
+        order: 1,
+      },
+    ]),
+  ),
+
+  http.post('/api/flights/:id/waypoints', async ({ request, params }) => {
+    const body = (await request.json()) as Record<string, unknown>
+    return jsonResponse({ id: 'wp-new', flightId: params.id, ...body }, { status: 201 })
+  }),
+
+  http.get('/api/flights/:id/live-gps', ({ params }) =>
+    sse([
+      { event: 'gps', data: { flightId: params.id, lat: 50.45, lon: 30.52, t: 0 }, id: '1' },
+      { event: 'gps', data: { flightId: params.id, lat: 50.46, lon: 30.53, t: 1000 }, id: '2' },
+      { event: 'gps', data: { flightId: params.id, lat: 50.47, lon: 30.54, t: 2000 }, id: '3' },
+    ]),
+  ),
+
+  http.get('/api/flights/aircraft', () => jsonResponse(seedAircraft)),
+
+  http.post('/api/flights/aircraft', async ({ request }) => {
+    const body = (await request.json()) as Record<string, unknown>
+    return jsonResponse({ id: 'aircraft-new', ...body }, { status: 201 })
+  }),
+]