Stabilize runtime auth and E2E coverage

apps/web/e2e/README.md

@@ -0,0 +1,51 @@
+# Playwright E2E
+
+These tests exercise the app through the Vite `/api` proxy and a running local
+FastAPI server. They do not replace `/auth/me`, `/personas`, sessions, admin, or
+review endpoints with Playwright route fixtures.
+
+Required local services:
+
+```sh
+# apps/api
+python -m uvicorn app.main:app --host 127.0.0.1 --port 8000
+
+# apps/web, started automatically by Playwright unless already running
+npm run dev -- --host 127.0.0.1 --port 5173
+```
+
+Useful overrides:
+
+```sh
+PLAYWRIGHT_PORT=5174 npm run e2e
+PLAYWRIGHT_BASE_URL=http://localhost:5173 npm run e2e
+VITE_API_BASE=http://127.0.0.1:8000 npm run e2e
+```
+
+Public Google OAuth `/turn` smoke:
+
+```sh
+# 1) Verify the public API is not accidentally serving the dev runtime.
+$env:E2E_PUBLIC_AUTH="1"
+npx playwright test e2e/public-auth-turn.spec.ts --project=chromium-public-auth --grep "production-safe"
+
+# 2) Open a browser, sign in with an allowed Google account, then close codegen.
+npx playwright codegen https://vignette.chanpaca.net/login --save-storage=./node_modules/.tmp/public-auth.json
+
+# 3) Reuse that authenticated storage state for the public API turn smoke.
+$env:E2E_PUBLIC_AUTH="1"
+$env:E2E_PUBLIC_STORAGE_STATE="./node_modules/.tmp/public-auth.json"
+npx playwright test e2e/public-auth-turn.spec.ts --project=chromium-public-auth
+```
+
+Notes:
+
+- `E2E_PUBLIC_AUTH=1` targets the public site and does not start the local Vite web server.
+- `public-auth.json` contains the HttpOnly API session cookie exported by Playwright. Treat it as sensitive and keep it under `node_modules/.tmp`.
+- The API session TTL is currently 8 hours, so recapture storage state when the smoke begins returning `401`.
+
+Install browser binaries once with:
+
+```sh
+npx playwright install chromium
+```