e2e: smoke + state specs, CI-only against isolated dind stack

playwright.config.ts mirrors Flight-Ops shape (remote browser default ws://192.168.1.4:3000/,
PW_REMOTE_BROWSER=0 local, E2E_BASE_URL/E2E_DEPLOY_CMD optional). smoke.spec.ts: landing
page + scificn components + /api/version. state.spec.ts: mid-run docker compose restart
via E2E_COMPOSE_ARGS, re-asserts the app serves (no auth — single player by design).

playwright.config.ts

@@ -0,0 +1,33 @@
+import { defineConfig } from '@playwright/test';
+
+// Browsers run on the shared remote Playwright server by default (AGENTS.md).
+// PW_REMOTE_BROWSER=0 → local browsers instead (CI, or boxes without LAN access to 192.168.1.4).
+const remoteBrowser = process.env.PW_REMOTE_BROWSER !== '0';
+
+if (!process.env.PW_TEST_CONNECT_WS_ENDPOINT && remoteBrowser) {
+  process.env.PW_TEST_CONNECT_WS_ENDPOINT = 'ws://192.168.1.4:3000/';
+}
+
+// App under test. Default: the live compose instance behind Traefik, deployed manually
+// before running the suite (AGENTS.md). When E2E_DEPLOY_CMD is set it runs as a webServer
+// and the suite waits for baseURL to come up — CI uses this to target an isolated stack
+// inside dind instead of production. All vars optional; unset = current local behavior.
+const deployCmd = process.env.E2E_DEPLOY_CMD;
+const baseUrl = process.env.E2E_BASE_URL ?? 'https://space-wanderer.dev.kkhost.pl';
+
+export default defineConfig({
+  testDir: './e2e',
+  globalSetup: './e2e/ci-diagnostics.ts',
+  // Serial execution: e2e/state.spec.ts restarts the compose container mid-run,
+  // which would break any other spec running concurrently in another worker.
+  workers: 1,
+  timeout: 300_000,
+  retries: 1,
+  use: {
+    baseURL: baseUrl,
+    trace: 'on-first-retry',
+  },
+  webServer: deployCmd
+    ? { command: deployCmd, url: baseUrl, reuseExistingServer: true, timeout: 600_000 }
+    : undefined,
+});