ci(web): Phase P6 — vite build in PR CI + headless E2E gate on trunk publishes (#1445)

- ci.yml: build step (vite build via turbo) runs on every PR pipeline after test
- publish.yml: e2e step boots the gateway from built dist (HOME/cwd-isolated
  throwaway PGlite) and runs the Playwright suite headless inside
  mcr.microsoft.com/playwright:v1.58.2-noble against the SPA bundle served
  exactly as production serves it; both kaniko publishes now gate on e2e
- serve-spa.ts: strip query strings before asset resolution; immutable
  cache-control for hashed assets (onSend hook); e2e spec covers both
- e2e suite hardened: globalSetup seeds admin+member through real
  bootstrap/better-auth APIs (Origin header for CSRF), loginAs waits for the
  post-login redirect (fixes 27-skipped race), stale #152-era assertions
  rewritten to the current command-driven UI, strict-mode violations fixed
  with level-1 heading queries and .or() auto-retrying locators
- verify-release mirrors the new build stage; playwright artifacts ignored

apps/web/e2e/helpers/auth.ts

@@ -13,11 +13,16 @@ export const ADMIN_USER = {
 };
 
 /**
- * Fill the login form and submit. Waits for navigation after success.
+ * Fill the login form and submit, then wait for the post-login redirect to
+ * /chat. On failed login the wait times out and is swallowed: the page stays
+ * on /login, and the callers' `test.skip(!url.includes('/chat'))` guards see
+ * that. Without this wait, every guard read page.url() before the redirect
+ * happened and skipped its suite even when login succeeded (#1445).
  */
 export async function loginAs(page: Page, email: string, password: string): Promise<void> {
   await page.goto('/login');
   await page.getByLabel('Email').fill(email);
   await page.getByLabel('Password').fill(password);
   await page.getByRole('button', { name: /sign in/i }).click();
+  await page.waitForURL(/\/chat/, { timeout: 10_000 }).catch(() => {});
 }