test(e2e): Playwright + Vitest coverage harness and test instrumentation

Add an end-to-end and unit test suite for the SvelteKit frontend:

- Playwright e2e specs (tests/e2e/spa) with a throwaway container stack,
  codegen scenarios, and an Istanbul-based coverage report pipeline.
- Vitest unit tests across API endpoints, components, stores and composables.
- `data-testid` hooks on interactive elements (AppShell, FileViewer,
  ShareDialog, search, photos, files breadcrumbs, login/Nextcloud flows,
  public share pages) so the e2e suite can target them deterministically.
- Serve the SPA app-shell CSP from a <meta> policy (svelte.config.js) plus a
  middleware that skips the CSP header on HTML; move the Nextcloud Login Flow
  v2 grant page to the SvelteKit /nextcloud/login route.
- `just front-codegen` recipe and start-server-spa.sh harness.

Make the test environment robust and consistent:
- Install a deterministic in-memory localStorage/sessionStorage in the Vitest
  setup so storage behaves identically across Node versions (Node 26 ships a
  native Web Storage global that otherwise shadows jsdom's).
- Pin devenv to Node 26 + PostgreSQL 18 and pin every CI job to Node 26.3.0
  so the dev shell and CI run the same toolchain versions.

Repair the API/WebDAV (hurl) suite, which had drifted from the backend:
- Migrate the removed `/api/folders/{id}/listing` endpoint to `/resources`
  (cursor-paginated `{items:[{resource_type,resource}]}` shape) across the
  batch-copy, grants, nested-group, and WebDAV NC tests + the dav_helpers
  wipe routine.
- Stop photos_etag from uploading the dedup-tracked fixture so the dedup
  blob-lifecycle test can own its content-addressed blob exclusively.
- dedup_create now asserts the idempotent same-content re-upload (201 +
  existing file id) instead of the stale 409 expectation.

Generated coverage reports, nyc output and the e2e server runtime data dir
are gitignored rather than committed.

src/interfaces/nextcloud/login_v2_handler.rs

@@ -2,7 +2,7 @@ use askama::Template;
 use axum::{
     extract::{Path, Query, State},
     http::{HeaderMap, StatusCode, header},
-    response::{Html, IntoResponse, Json, Response},
+    response::{Html, IntoResponse, Json, Redirect, Response},
 };
 use serde_json::json;
 use std::collections::HashMap;
@@ -29,31 +29,12 @@ struct DrivePickerTemplate {
     drives: Vec<DriveOption>,
 }
 
-/// The Nextcloud Login Flow v2 "Grant Access" page. Rendered server-side via
-/// askama (no template variables — the username/password are collected by the
-/// embedded form); the template is embedded at compile time by the derive macro.
-#[derive(Template)]
-#[template(path = "nextcloud/login.html")]
-struct NextcloudLoginTemplate;
-
 // Home identification is via `position_of_user_home_root_folder` from
 // `domain::repositories::drive_repository` — a generic helper that
 // keys off `drives.default_for_user == user_id` rather than folder
 // name, so user renames of the home folder don't silently break the
 // picker UX.
 
-/// Serve an HTML page with a Content-Security-Policy header as defense-in-depth.
-fn html_with_csp(html: String) -> Response {
-    (
-        [(
-            header::CONTENT_SECURITY_POLICY,
-            "default-src 'none'; script-src 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; form-action 'self'",
-        )],
-        Html(html),
-    )
-        .into_response()
-}
-
 pub async fn handle_login_initiate(State(state): State<Arc<AppState>>) -> Response {
     let nextcloud = match state.nextcloud.as_ref() {
         Some(nextcloud) => nextcloud,
@@ -167,13 +148,10 @@ pub async fn handle_login_page(
         return StatusCode::NOT_FOUND.into_response();
     }
 
-    match NextcloudLoginTemplate.render() {
-        Ok(html) => html_with_csp(html),
-        Err(e) => {
-            tracing::error!(error = %e, "Login Flow v2: login page template render failed");
-            StatusCode::INTERNAL_SERVER_ERROR.into_response()
-        }
-    }
+    // The grant-access page is now owned by the SvelteKit SPA at
+    // /nextcloud/login; redirect the client's browser there with the flow
+    // token. The page POSTs back to /login/v2/flow/{token} (handle_login_submit).
+    Redirect::to(&format!("/nextcloud/login?token={token}")).into_response()
 }
 
 pub async fn handle_login_submit(