The e2e suite names its own origins, and refuses a live instance

`tests/utils/api.ts` took the API origin from `VITE_API_URL`, which
`tests/config.ts` loads out of `app/.env`. In a checkout configured for a
deployment that names the deployment — so the browser went to the local stack
while every setup and teardown call, `deleteAll` included, went to the live
one. `privateApi.ts` had the same reading, and it creates users.

Both origins now come from one place: `PLAYWRIGHT_BASE_URL`, with the API
derived from it (`app.<domain>` → `api.<domain>`) or named outright by
`PLAYWRIGHT_API_URL`, which is what CI and the compose service set. Nothing in
the suite reads `VITE_API_URL` any more.

Belt and braces, since a stack served under a real domain answers to the same
names its production instance does: a global setup resolves both origins and
refuses anything that is not loopback or a private range, before a test runs.
`PLAYWRIGHT_ALLOW_PUBLIC=1` says you meant it.

`make test-frontend` is now that safe run — the Playwright image on the proxy
network with both names mapped onto Traefik by address, as the host user so it
does not leave root-owned results behind.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NUb8YpL2s3gmN9WTACTt4q

frontend/tests/flows.spec.ts

@@ -1,4 +1,5 @@
 import { expect, type Page, test } from "@playwright/test"
+import { apiUrl } from "./config.ts"
 import { deleteAll } from "./utils/api"
 
 /**
@@ -17,8 +18,6 @@ test.afterAll(async ({ browser }) => {
   await deleteAll(browser, [`/flows/${flowName}`])
 })
 
-const apiUrl = process.env.VITE_API_URL || "http://api.localhost"
-
 /** Write a node's source through the API; typing code is not what we test. */
 async function setNodeSource(page: Page, nodeId: string, code: string) {
   const token = await page.evaluate(() => localStorage.getItem("access_token"))