test(e2e): Playwright + Vitest coverage harness and test instrumentation

Add an end-to-end and unit test suite for the SvelteKit frontend:

- Playwright e2e specs (tests/e2e/spa) with a throwaway container stack,
  codegen scenarios, and an Istanbul-based coverage report pipeline.
- Vitest unit tests across API endpoints, components, stores and composables.
- `data-testid` hooks on interactive elements (AppShell, FileViewer,
  ShareDialog, search, photos, files breadcrumbs, login/Nextcloud flows,
  public share pages) so the e2e suite can target them deterministically.
- Serve the SPA app-shell CSP from a <meta> policy (svelte.config.js) plus a
  middleware that skips the CSP header on HTML; move the Nextcloud Login Flow
  v2 grant page to the SvelteKit /nextcloud/login route.
- `just front-codegen` recipe and start-server-spa.sh harness.

Make the test environment robust and consistent:
- Install a deterministic in-memory localStorage/sessionStorage in the Vitest
  setup so storage behaves identically across Node versions (Node 26 ships a
  native Web Storage global that otherwise shadows jsdom's).
- Pin devenv to Node 26 + PostgreSQL 18 and pin every CI job to Node 26.3.0
  so the dev shell and CI run the same toolchain versions.

Repair the API/WebDAV (hurl) suite, which had drifted from the backend:
- Migrate the removed `/api/folders/{id}/listing` endpoint to `/resources`
  (cursor-paginated `{items:[{resource_type,resource}]}` shape) across the
  batch-copy, grants, nested-group, and WebDAV NC tests + the dav_helpers
  wipe routine.
- Stop photos_etag from uploading the dedup-tracked fixture so the dedup
  blob-lifecycle test can own its content-addressed blob exclusively.
- dedup_create now asserts the idempotent same-content re-upload (201 +
  existing file id) instead of the stale 409 expectation.

Generated coverage reports, nyc output and the e2e server runtime data dir
are gitignored rather than committed.

tests/webdav/lib/dav_helpers.sh

@@ -284,12 +284,12 @@ api_empty_trash() {
 wipe_home_folder() {
     [[ -n "${HOME_FOLDER_ID:-}" ]] \
         || fail "wipe_home_folder: HOME_FOLDER_ID is unset — call resolve_home_folder_id first"
-    # `/listing` (NOT `/contents`) is the endpoint that returns the
-    # `.files[]` / `.folders[]` arrays we iterate here — same one
-    # `tests/api/storage_cleanup_check.sh` uses for the equivalent
-    # full-tree wipe before its disk-audit step.
+    # `/resources` (the `/listing` and `/contents` endpoints were removed)
+    # returns `{ items: [{ resource_type, resource }] }`; split the items by
+    # `resource_type` to iterate child files and folders. `limit=200` covers
+    # any test home folder in one page.
     local listing
-    listing=$(api_curl "$base_url/api/folders/$HOME_FOLDER_ID/listing")
+    listing=$(api_curl "$base_url/api/folders/$HOME_FOLDER_ID/resources?limit=200")
     # Delete every direct child file (recursive contents go with the
     # file's row). Errors are swallowed because the test that called
     # us doesn't care WHY a leftover was unreachable — it just wants
@@ -297,12 +297,12 @@ wipe_home_folder() {
     while IFS= read -r fid; do
         [[ -z "$fid" || "$fid" == "null" ]] && continue
         api_curl -X DELETE "$base_url/api/files/$fid" > /dev/null 2>&1 || true
-    done < <(jq -r '.files[]?.id   // empty' <<< "$listing")
+    done < <(jq -r '.items[]? | select(.resource_type == "file")   | .resource.id // empty' <<< "$listing")
     # Then every direct child folder (recursive subtree goes with).
     while IFS= read -r fid; do
         [[ -z "$fid" || "$fid" == "null" ]] && continue
         api_curl -X DELETE "$base_url/api/folders/$fid" > /dev/null 2>&1 || true
-    done < <(jq -r '.folders[]?.id // empty' <<< "$listing")
+    done < <(jq -r '.items[]? | select(.resource_type == "folder") | .resource.id // empty' <<< "$listing")
     # Finally permanently delete everything in trash so the row-level
     # `is_trashed` orphans the upstream tests left behind don't make
     # *us* leak chunks/blobs into storage_cleanup_check's audit.

tests/webdav/test_nc_chunked_upload_assembly_blake3.sh

@@ -183,10 +183,11 @@ pass "J6: assembled file is byte-identical to concat(chunk1, chunk2)"
 # dedup / lifecycle hooks downstream key on.
 # ─────────────────────────────────────────────────────────────
 echo "  J7: BLAKE3 round-trip on assembled file (HEADLINE)"
-# Find the assembled file's id via the REST listing.
-listing=$(api_curl "$base_url/api/folders/$HOME_FOLDER_ID/listing")
-ASSEMBLED_ID=$(jq -r '.files[]?       | select(.name == "j-assembled.bin") | .id'           <<< "$listing")
-SERVER_HASH=$(jq -r '.files[]?        | select(.name == "j-assembled.bin") | .content_hash' <<< "$listing")
+# Find the assembled file's id via the REST `/resources` listing
+# ({ items: [{ resource_type, resource }] }; `/listing` was removed).
+listing=$(api_curl "$base_url/api/folders/$HOME_FOLDER_ID/resources?resource_types=file&limit=200")
+ASSEMBLED_ID=$(jq -r '.items[]?.resource | select(.name == "j-assembled.bin") | .id'           <<< "$listing")
+SERVER_HASH=$(jq -r '.items[]?.resource  | select(.name == "j-assembled.bin") | .content_hash' <<< "$listing")
 [[ -n "$ASSEMBLED_ID" && "$ASSEMBLED_ID" != "null" ]] \
     || fail "J7: assembled file not visible via REST listing"
 [[ -n "$SERVER_HASH"  && "$SERVER_HASH"  != "null" ]] \

tests/webdav/test_nc_put_mkcol_blake3.sh

@@ -60,19 +60,16 @@ header_value() {
 
 # ── Helper: list home folder, find file by name, capture id + content_hash ───
 #
-# Uses `/listing` (NOT `/contents`): `/contents` is deprecated AND
-# its response shape was changed from `{files, folders}` to a flat
-# array, so callers that try `.files[]` fail with "Cannot index
-# array with string 'files'". The non-deprecated `/listing`
-# endpoint still returns the `.files[] / .folders[]` shape we
-# need here. Same endpoint `wipe_home_folder` + the API cleanup
-# audit (`tests/api/storage_cleanup_check.sh`) use.
+# Uses the cursor-paginated `/resources` listing (the `/listing` and
+# `/contents` endpoints were removed). `?resource_types=file` returns only
+# file rows as `{ items: [{ resource_type, resource }], next_cursor }`, so
+# the file DTO (id + content_hash) is at `.items[].resource`.
 nc_lookup_via_rest() {
     local name="$1"
     local response
-    response=$(api_curl "$base_url/api/folders/$HOME_FOLDER_ID/listing")
-    LAST_FILE_ID=$(jq -r --arg n "$name" '.files[]? | select(.name == $n) | .id'           <<< "$response")
-    LAST_FILE_CONTENT_HASH=$(jq -r --arg n "$name" '.files[]? | select(.name == $n) | .content_hash' <<< "$response")
+    response=$(api_curl "$base_url/api/folders/$HOME_FOLDER_ID/resources?resource_types=file&limit=200")
+    LAST_FILE_ID=$(jq -r --arg n "$name" '.items[]?.resource | select(.name == $n) | .id'           <<< "$response")
+    LAST_FILE_CONTENT_HASH=$(jq -r --arg n "$name" '.items[]?.resource | select(.name == $n) | .content_hash' <<< "$response")
     [[ -n "$LAST_FILE_ID" && "$LAST_FILE_ID" != "null" ]] \
         || fail "REST lookup for '$name' in home folder returned no id (response: $response)"
 }