The e2e suite names its own origins, and refuses a live instance

`tests/utils/api.ts` took the API origin from `VITE_API_URL`, which
`tests/config.ts` loads out of `app/.env`. In a checkout configured for a
deployment that names the deployment — so the browser went to the local stack
while every setup and teardown call, `deleteAll` included, went to the live
one. `privateApi.ts` had the same reading, and it creates users.

Both origins now come from one place: `PLAYWRIGHT_BASE_URL`, with the API
derived from it (`app.<domain>` → `api.<domain>`) or named outright by
`PLAYWRIGHT_API_URL`, which is what CI and the compose service set. Nothing in
the suite reads `VITE_API_URL` any more.

Belt and braces, since a stack served under a real domain answers to the same
names its production instance does: a global setup resolves both origins and
refuses anything that is not loopback or a private range, before a test runs.
`PLAYWRIGHT_ALLOW_PUBLIC=1` says you meant it.

`make test-frontend` is now that safe run — the Playwright image on the proxy
network with both names mapped onto Traefik by address, as the host user so it
does not leave root-owned results behind.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NUb8YpL2s3gmN9WTACTt4q

frontend/tests/utils/api.ts

@@ -8,8 +8,9 @@ import type { Browser, Page } from "@playwright/test"
  * database. What a spec leaves behind is in someone's flow list tomorrow.
  */
 
+import { apiUrl } from "../config.ts"
+
 const authFile = "playwright/.auth/user.json"
-const apiUrl = process.env.VITE_API_URL || "http://api.localhost"
 
 /** Call the API as the logged-in user of *page*. */
 export async function api(

frontend/tests/utils/privateApi.ts

@@ -1,8 +1,11 @@
 // Note: the `PrivateService` is only available when generating the client
 // for local environments
 import { OpenAPI, PrivateService } from "../../src/client"
+import { apiUrl } from "../config.ts"
 
-OpenAPI.BASE = `${process.env.VITE_API_URL}`
+// The same origin the rest of the suite writes to, for the same reason: this
+// one creates users.
+OpenAPI.BASE = apiUrl
 
 export const createUser = async ({
   email,