test(e2e): Playwright + Vitest coverage harness and test instrumentation

Add an end-to-end and unit test suite for the SvelteKit frontend:

- Playwright e2e specs (tests/e2e/spa) with a throwaway container stack,
  codegen scenarios, and an Istanbul-based coverage report pipeline.
- Vitest unit tests across API endpoints, components, stores and composables.
- `data-testid` hooks on interactive elements (AppShell, FileViewer,
  ShareDialog, search, photos, files breadcrumbs, login/Nextcloud flows,
  public share pages) so the e2e suite can target them deterministically.
- Serve the SPA app-shell CSP from a <meta> policy (svelte.config.js) plus a
  middleware that skips the CSP header on HTML; move the Nextcloud Login Flow
  v2 grant page to the SvelteKit /nextcloud/login route.
- `just front-codegen` recipe and start-server-spa.sh harness.

Make the test environment robust and consistent:
- Install a deterministic in-memory localStorage/sessionStorage in the Vitest
  setup so storage behaves identically across Node versions (Node 26 ships a
  native Web Storage global that otherwise shadows jsdom's).
- Pin devenv to Node 26 + PostgreSQL 18 and pin every CI job to Node 26.3.0
  so the dev shell and CI run the same toolchain versions.

Repair the API/WebDAV (hurl) suite, which had drifted from the backend:
- Migrate the removed `/api/folders/{id}/listing` endpoint to `/resources`
  (cursor-paginated `{items:[{resource_type,resource}]}` shape) across the
  batch-copy, grants, nested-group, and WebDAV NC tests + the dav_helpers
  wipe routine.
- Stop photos_etag from uploading the dedup-tracked fixture so the dedup
  blob-lifecycle test can own its content-addressed blob exclusively.
- dedup_create now asserts the idempotent same-content re-upload (201 +
  existing file id) instead of the stale 409 expectation.

Generated coverage reports, nyc output and the e2e server runtime data dir
are gitignored rather than committed.

frontend/src/routes/device/+page.svelte

@@ -123,11 +123,12 @@
 		<h1>{t('device.title', 'Device verification')}</h1>
 
 		{#if step === 'code'}
-			<form onsubmit={lookup}>
+			<form data-testid="device-code-form" onsubmit={lookup}>
 				<label class="device__field">
 					<span>{t('device.enter_code', 'Enter the code shown on your device')}</span>
 					<input
 						bind:this={codeInput}
+						data-testid="device-code-input"
 						value={code}
 						oninput={onCodeInput}
 						autocomplete="off"
@@ -137,7 +138,9 @@
 						maxlength={FULL_CODE_LENGTH}
 					/>
 				</label>
-				<button type="submit" disabled={!code}>{t('device.continue', 'Continue')}</button>
+				<button type="submit" data-testid="device-continue-btn" disabled={!code}
+					>{t('device.continue', 'Continue')}</button
+				>
 			</form>
 		{:else if step === 'loading'}
 			<p>{t('common.loading', 'Loading…')}</p>
@@ -149,10 +152,20 @@
 				<dd>{info?.scopes || 'all'}</dd>
 			</dl>
 			<div class="device__actions">
-				<button class="device__deny" disabled={busy} onclick={() => decide('deny')}>
+				<button
+					class="device__deny"
+					data-testid="device-deny-btn"
+					disabled={busy}
+					onclick={() => decide('deny')}
+				>
 					{t('device.deny', 'Deny')}
 				</button>
-				<button class="device__approve" disabled={busy} onclick={() => decide('approve')}>
+				<button
+					class="device__approve"
+					data-testid="device-approve-btn"
+					disabled={busy}
+					onclick={() => decide('approve')}
+				>
 					{t('device.approve', 'Approve')}
 				</button>
 			</div>
@@ -164,7 +177,9 @@
 			<p>{t('device.denied', 'Device access denied.')}</p>
 		{:else if step === 'error'}
 			<p class="device__error" role="alert">{errorText}</p>
-			<button onclick={backToCode}>{t('common.retry', 'Try again')}</button>
+			<button data-testid="device-retry-btn" onclick={backToCode}
+				>{t('common.retry', 'Try again')}</button
+			>
 		{/if}
 	</div>
 </main>

frontend/src/routes/device/page.test.ts

@@ -0,0 +1,60 @@
+import { it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, fireEvent, waitFor } from '@testing-library/svelte';
+
+const { pageState } = vi.hoisted(() => ({
+	pageState: { url: new URL('http://localhost/device') }
+}));
+vi.mock('$app/state', () => ({ page: pageState }));
+vi.mock('$lib/api/endpoints/device', () => {
+	class DeviceLookupFailure extends Error {}
+	return {
+		DeviceLookupFailure,
+		decideDevice: vi.fn(),
+		lookupDeviceCode: vi.fn()
+	};
+});
+
+import { decideDevice, lookupDeviceCode } from '$lib/api/endpoints/device';
+import DevicePage from './+page.svelte';
+
+const m = (fn: unknown) => fn as ReturnType<typeof vi.fn>;
+const info = { user_code: 'WXYZ-1234', client_name: 'CLI', scopes: ['files'] };
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	pageState.url = new URL('http://localhost/device');
+});
+
+it('looks up a typed code and shows the review step', async () => {
+	m(lookupDeviceCode).mockResolvedValue(info);
+	render(DevicePage);
+	await screen.findByTestId('device-code-form');
+	await fireEvent.input(screen.getByTestId('device-code-input'), {
+		target: { value: 'WXYZ-1234' }
+	});
+	await fireEvent.click(screen.getByTestId('device-continue-btn'));
+	await waitFor(() => expect(lookupDeviceCode).toHaveBeenCalledWith('WXYZ-1234'));
+	await screen.findByTestId('device-approve-btn');
+});
+
+it('approves a device after lookup', async () => {
+	m(lookupDeviceCode).mockResolvedValue(info);
+	m(decideDevice).mockResolvedValue(undefined);
+	render(DevicePage);
+	await fireEvent.input(await screen.findByTestId('device-code-input'), {
+		target: { value: 'WXYZ-1234' }
+	});
+	await fireEvent.click(screen.getByTestId('device-continue-btn'));
+	await fireEvent.click(await screen.findByTestId('device-approve-btn'));
+	await waitFor(() => expect(decideDevice).toHaveBeenCalled());
+});
+
+it('shows an error when lookup fails', async () => {
+	m(lookupDeviceCode).mockRejectedValue(new Error('nope'));
+	render(DevicePage);
+	await fireEvent.input(await screen.findByTestId('device-code-input'), {
+		target: { value: 'BAD' }
+	});
+	await fireEvent.click(screen.getByTestId('device-continue-btn'));
+	await screen.findByTestId('device-retry-btn');
+});