Local test targets read the running stack, not the deployment's domain

`make test-frontend` built PLAYWRIGHT_BASE_URL from DOMAIN in .env, which in a
checkout configured for a deployment is that deployment's domain — so the suite
that creates and deletes flows, dashboards and users was pointed at
app.fluksio.com, held local only by --add-host and tests/guard.ts.

The hostname now comes off the running stack (the frontend container's own
Traefik rule), so a name no local container answers to cannot be reached at
all, and the local targets default to *.localhost instead of reading .env.
Target-specific on purpose: an exported DOMAIN outranks --env-file in compose
interpolation and would put the production targets on localhost.

`rebuild-frontend` replaces the raw compose line CLAUDE.md spelled out, taking
the same domain so the baked VITE_API_URL cannot disagree with what Traefik
serves. Also: a coverage HTML report that cannot be written no longer fails
test-backend after a green suite, and both artifact actions in playwright.yml
drop to @v3, which is the only version without the github.com-only guard that
failed every run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/playwright.yml

@@ -87,13 +87,16 @@ jobs:
       - name: Tear down
         if: always()
         run: docker compose down -v --remove-orphans
+      # v3 deliberately: @v4 of both artifact actions refuses to run against
+      # anything that is not github.com (GHESNotSupportedError), which failed
+      # every run here after the tests had already passed. `include-hidden-files`
+      # is v4-only and comes off with it — a blob report holds no dotfiles.
       - name: Upload blob report
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: blob-report-${{ matrix.shardIndex }}
           path: frontend/blob-report
-          include-hidden-files: true
           retention-days: 1
 
   merge-reports:
@@ -108,19 +111,23 @@ jobs:
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
+      # v3 has no `pattern:`/`merge-multiple:`, so it lands one directory per
+      # artifact and merge-reports needs them flattened first.
       - name: Download blob reports
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v3
         with:
           path: frontend/all-blob-reports
-          pattern: blob-report-*
-          merge-multiple: true
+      - name: Flatten the per-shard directories
+        run: |
+          find frontend/all-blob-reports -mindepth 2 -type f \
+            -exec mv -t frontend/all-blob-reports {} +
+          find frontend/all-blob-reports -mindepth 1 -type d -empty -delete
       - name: Merge into an HTML report
         run: bunx playwright merge-reports --reporter html ./all-blob-reports
         working-directory: frontend
       - name: Upload HTML report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: html-report--attempt-${{ github.run_attempt }}
           path: frontend/playwright-report
-          include-hidden-files: true
           retention-days: 7