ci(web): Phase P6 — vite build in PR CI + headless E2E gate on trunk publishes (#1445)

- ci.yml: build step (vite build via turbo) runs on every PR pipeline after test
- publish.yml: e2e step boots the gateway from built dist (HOME/cwd-isolated
  throwaway PGlite) and runs the Playwright suite headless inside
  mcr.microsoft.com/playwright:v1.58.2-noble against the SPA bundle served
  exactly as production serves it; both kaniko publishes now gate on e2e
- serve-spa.ts: strip query strings before asset resolution; immutable
  cache-control for hashed assets (onSend hook); e2e spec covers both
- e2e suite hardened: globalSetup seeds admin+member through real
  bootstrap/better-auth APIs (Origin header for CSRF), loginAs waits for the
  post-login redirect (fixes 27-skipped race), stale #152-era assertions
  rewritten to the current command-driven UI, strict-mode violations fixed
  with level-1 heading queries and .or() auto-retrying locators
- verify-release mirrors the new build stage; playwright artifacts ignored

scripts/verify-release.mjs

@@ -21,10 +21,10 @@
 //   lint          | lint                | pnpm lint
 //   format        | format              | pnpm format:check
 //   test          | test                | pnpm test
-//   build         | publish.yml build   | pnpm build
+//   build         | build (#1445, P6)   | pnpm build (also publish.yml build)
 //   quality-rails | (canonical-only)    | the TS quality-rails evaluator
-//                |                     | (RI-N4, QC-19 monorepo subject). Like
-//                |                     | `build`, this stage has no ci.yml
+//                |                     | (RI-N4, QC-19 monorepo subject).
+//                |                     | The one stage with no ci.yml
 //                |                     | mirror; it is implemented by
 //                |                     | importing the evaluator CLI rather
 //                |                     | than duplicating its presence logic.