Add Playwright e2e tests; fix two real bugs they caught

fix: OIDC_ISSUER_URL used Authentik's LAN IP (192.168.1.208:9443).
Authentik's discovery doc echoes back whichever host you query it
through, so that LAN IP got baked into authorization_endpoint -- the
URL the *browser* gets redirected to. Anyone off the LAN got sent to
an address they couldn't reach. Authentik was already publicly
exposed at auth.jerodrigged.com (pre-existing NPM proxy host); switched
to that, which also has a real cert so OIDC_ALLOW_INSECURE_TLS could
go back to false. Reported as "signed in via Authentik, redirected to
the local IP, failed."

fix: frontend's request() helper always sent Content-Type:
application/json, even for logout's bodyless POST. Fastify's default
JSON parser rejects an empty body under that content-type (400) --
sign-out silently failed to log the user out. curl-based testing
missed this because curl doesn't set that header without -d. Caught
immediately by the new Playwright local-login test.

e2e/: Playwright suite for local auth and OIDC login. OIDC test uses
a dedicated Authentik test user (blueprint-provisioned, never a real
personal login) so the whole flow can run unattended and repeatedly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

e2e/tests/oidc-login.spec.ts

@@ -0,0 +1,33 @@
+import { test, expect } from "@playwright/test";
+
+const USERNAME = process.env.OIDC_USERNAME ?? "playwright-test";
+const PASSWORD = process.env.OIDC_PASSWORD ?? "";
+
+test("OIDC login via Authentik stays on public domains throughout", async ({ page }) => {
+  test.skip(!PASSWORD, "OIDC_PASSWORD not set");
+
+  await page.goto("/");
+  const oidcButton = page.getByRole("link", { name: "Sign in with Authentik" });
+  await expect(oidcButton).toBeVisible();
+  await oidcButton.click();
+
+  // Regression check for the actual bug reported: the authorization endpoint
+  // must be the public auth.jerodrigged.com, never a LAN IP a browser off the
+  // LAN can't reach.
+  await page.waitForURL(/^https:\/\/auth\.jerodrigged\.com\//, { timeout: 10_000 });
+  expect(page.url()).not.toMatch(/192\.168\./);
+
+  await page.getByPlaceholder(/email or username/i).fill(USERNAME);
+  await page.getByRole("button", { name: /log in|continue|next/i }).click();
+
+  await page.getByLabel(/password/i).fill(PASSWORD);
+  await page.getByRole("button", { name: /log in|continue|sign in/i }).click();
+
+  await page.waitForURL(/^https:\/\/monitor\.jerodrigged\.com\//, { timeout: 15_000 });
+  expect(page.url()).not.toMatch(/192\.168\./);
+
+  await expect(page.locator(".host-card").first()).toBeVisible({ timeout: 15_000 });
+
+  await page.getByRole("button", { name: "Sign out" }).click();
+  await expect(page.getByPlaceholder("Username")).toBeVisible();
+});