Local test targets read the running stack, not the deployment's domain

`make test-frontend` built PLAYWRIGHT_BASE_URL from DOMAIN in .env, which in a
checkout configured for a deployment is that deployment's domain — so the suite
that creates and deletes flows, dashboards and users was pointed at
app.fluksio.com, held local only by --add-host and tests/guard.ts.

The hostname now comes off the running stack (the frontend container's own
Traefik rule), so a name no local container answers to cannot be reached at
all, and the local targets default to *.localhost instead of reading .env.
Target-specific on purpose: an exported DOMAIN outranks --env-file in compose
interpolation and would put the production targets on localhost.

`rebuild-frontend` replaces the raw compose line CLAUDE.md spelled out, taking
the same domain so the baked VITE_API_URL cannot disagree with what Traefik
serves. Also: a coverage HTML report that cannot be written no longer fails
test-backend after a green suite, and both artifact actions in playwright.yml
drop to @v3, which is the only version without the github.com-only guard that
failed every run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/scripts/test.sh

@@ -5,4 +5,7 @@ set -x
 
 coverage run -m pytest tests/
 coverage report
-coverage html --title "${@-coverage}"
+# The HTML report is a convenience: a container run can leave htmlcov/ owned by
+# root, and failing here after a green suite reads like a test failure.
+coverage html --title "${@-coverage}" \
+  || echo "  ! coverage html failed (htmlcov/ not writable? try 'make clean') — tests passed" >&2