test(e2e): Playwright + Vitest coverage harness and test instrumentation

Add an end-to-end and unit test suite for the SvelteKit frontend:

- Playwright e2e specs (tests/e2e/spa) with a throwaway container stack,
  codegen scenarios, and an Istanbul-based coverage report pipeline.
- Vitest unit tests across API endpoints, components, stores and composables.
- `data-testid` hooks on interactive elements (AppShell, FileViewer,
  ShareDialog, search, photos, files breadcrumbs, login/Nextcloud flows,
  public share pages) so the e2e suite can target them deterministically.
- Serve the SPA app-shell CSP from a <meta> policy (svelte.config.js) plus a
  middleware that skips the CSP header on HTML; move the Nextcloud Login Flow
  v2 grant page to the SvelteKit /nextcloud/login route.
- `just front-codegen` recipe and start-server-spa.sh harness.

Make the test environment robust and consistent:
- Install a deterministic in-memory localStorage/sessionStorage in the Vitest
  setup so storage behaves identically across Node versions (Node 26 ships a
  native Web Storage global that otherwise shadows jsdom's).
- Pin devenv to Node 26 + PostgreSQL 18 and pin every CI job to Node 26.3.0
  so the dev shell and CI run the same toolchain versions.

Repair the API/WebDAV (hurl) suite, which had drifted from the backend:
- Migrate the removed `/api/folders/{id}/listing` endpoint to `/resources`
  (cursor-paginated `{items:[{resource_type,resource}]}` shape) across the
  batch-copy, grants, nested-group, and WebDAV NC tests + the dav_helpers
  wipe routine.
- Stop photos_etag from uploading the dedup-tracked fixture so the dedup
  blob-lifecycle test can own its content-addressed blob exclusively.
- dedup_create now asserts the idempotent same-content re-upload (201 +
  existing file id) instead of the stale 409 expectation.

Generated coverage reports, nyc output and the e2e server runtime data dir
are gitignored rather than committed.

frontend/src/lib/components/MoveDialog.svelte

@@ -123,51 +123,73 @@
 </script>
 
 <Modal bind:open title={moveTitle}>
-	<div class="mv-nav">
-		<button
-			class="mv-nav-btn"
-			title={t('breadcrumb.home', 'Home')}
-			aria-label={t('breadcrumb.home', 'Home')}
-			disabled={atHome}
-			onclick={goHome}><Icon name="home" /></button
-		>
-		<button
-			class="mv-nav-btn"
-			title={t('dialogs.go_to_parent', 'Go to parent')}
-			aria-label={t('dialogs.go_to_parent', 'Go to parent')}
-			disabled={atHome}
-			onclick={goParent}><Icon name="level-up-alt" /></button
-		>
-		<nav class="mv-crumbs" aria-label="Breadcrumb">
-			{#each crumbs as c, i (c.id)}
-				{#if i > 0}<span class="mv-sep">/</span>{/if}
-				<button class="mv-crumb" onclick={() => gotoCrumb(i)}>{c.name}</button>
-			{/each}
-		</nav>
+	<div data-testid="move-dialog">
+		<div class="mv-nav">
+			<button
+				class="mv-nav-btn"
+				data-testid="move-dialog-home-btn"
+				title={t('breadcrumb.home', 'Home')}
+				aria-label={t('breadcrumb.home', 'Home')}
+				disabled={atHome}
+				onclick={goHome}><Icon name="home" /></button
+			>
+			<button
+				class="mv-nav-btn"
+				data-testid="move-dialog-parent-btn"
+				title={t('dialogs.go_to_parent', 'Go to parent')}
+				aria-label={t('dialogs.go_to_parent', 'Go to parent')}
+				disabled={atHome}
+				onclick={goParent}><Icon name="level-up-alt" /></button
+			>
+			<nav class="mv-crumbs" aria-label="Breadcrumb">
+				{#each crumbs as c, i (c.id)}
+					{#if i > 0}<span class="mv-sep">/</span>{/if}
+					<button
+						class="mv-crumb"
+						data-testid={`move-dialog-crumb-${c.id}`}
+						onclick={() => gotoCrumb(i)}>{c.name}</button
+					>
+				{/each}
+			</nav>
+		</div>
+
+		{#if loading}
+			<p class="mv-status">{t('common.loading', 'Loading…')}</p>
+		{:else if folders.length === 0}
+			<p class="mv-status">{t('files.no_subfolders', 'No subfolders here.')}</p>
+		{:else}
+			<ul class="mv-list">
+				{#each folders as f (f.id)}
+					<li>
+						<button
+							class="mv-folder"
+							data-testid={`move-dialog-folder-${f.id}`}
+							disabled={targetIds.has(f.id)}
+							onclick={() => enter(f)}
+						>
+							<Icon name="folder" /> <span>{f.name}</span>
+							<Icon name="chevron-right" class="mv-enter" />
+						</button>
+					</li>
+				{/each}
+			</ul>
+		{/if}
 	</div>
 
-	{#if loading}
-		<p class="mv-status">{t('common.loading', 'Loading…')}</p>
-	{:else if folders.length === 0}
-		<p class="mv-status">{t('files.no_subfolders', 'No subfolders here.')}</p>
-	{:else}
-		<ul class="mv-list">
-			{#each folders as f (f.id)}
-				<li>
-					<button class="mv-folder" disabled={targetIds.has(f.id)} onclick={() => enter(f)}>
-						<Icon name="folder" /> <span>{f.name}</span>
-						<Icon name="chevron-right" class="mv-enter" />
-					</button>
-				</li>
-			{/each}
-		</ul>
-	{/if}
-
 	{#snippet footer()}
-		<button class="btn btn-secondary" onclick={() => (open = false)}>
+		<button
+			class="btn btn-secondary"
+			data-testid="move-dialog-cancel-btn"
+			onclick={() => (open = false)}
+		>
 			{t('common.cancel', 'Cancel')}
 		</button>
-		<button class="btn btn-primary" disabled={working || !currentId} onclick={confirmMove}>
+		<button
+			class="btn btn-primary"
+			data-testid="move-dialog-confirm-btn"
+			disabled={working || !currentId}
+			onclick={confirmMove}
+		>
 			{mode === 'copy' ? t('files.copy_here', 'Copy here') : t('files.move_here', 'Move here')}
 		</button>
 	{/snippet}