test: add the end-to-end suite, on desktop and on a phone

Twenty-six tests across two viewports, covering what the spec asks for:
changing today's hours reaches the panel, a message survives the
translation service being unavailable, a closure period closes the days
it covers — plus the authorisation paths and the sign-out regression.

They run against the standalone build served the way the container
serves it, not `next start`, which refuses to work with standalone
output anyway. The suite therefore exercises the artifact that ships
rather than a second arrangement that could drift from it.

Sign-in mints the session cookie Auth.js would have issued rather than
driving Authentik. What is under test is the application's behaviour for
a given role; the handshake itself is verified against the live provider
separately, and standing up an identity provider per run would trade a
lot of machinery for coverage of somebody else's code. The secret lives
in one module imported by both the config and the fixtures — when it
differed, every signed-in test failed at once while looking like an
authorisation bug.

Database access goes through plain SQL rather than the Prisma client,
whose generated module format Playwright's loader and Next's bundler
disagree about. That traded one problem for a subtler one: node-postgres
parses a DATE column into a local-midnight Date, so reading it back
shifted the day at UTC+2. Dates are read as text now.

The mobile profile runs on Chromium: WebKit needs system packages only
root can install, and a suite nobody can run locally is a suite nobody
runs. The config says how to switch to the real engine.

Two real defects surfaced, both found by the tests rather than by
reading. The seven "Ouvert" checkboxes on the hours page were
indistinguishable to a screen reader; each now names its day. And on a
phone the signed-in address appeared nowhere at all — the header hides
it to save room — so nobody could tell which account was about to sign
an audit entry on a device the shop shares. It is on the dashboard now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012cSY9pVhZmJUKNN7wf1Myd

e2e/global-setup.ts

@@ -0,0 +1,24 @@
+import 'dotenv/config';
+
+import { E2E_AUTH_SECRET } from './constants';
+
+/**
+ * Prepares the environment the test process itself runs in.
+ *
+ * Loading .env is convenient for TEST_DATABASE_URL, but it also brings the
+ * real AUTH_SECRET along — which would then differ from the one the server
+ * under test was started with, and every signed-in test would fail looking
+ * like an authorisation bug. Pinning it here keeps both sides in agreement.
+ *
+ * The suite truncates every table, so an unset TEST_DATABASE_URL is a hard
+ * stop rather than a fallback to whatever DATABASE_URL happens to point at.
+ */
+export default function globalSetup(): void {
+  if (!process.env.TEST_DATABASE_URL) {
+    throw new Error(
+      'TEST_DATABASE_URL n’est pas défini. Les tests E2E vident la base : ils refusent de tourner sans base dédiée.',
+    );
+  }
+  process.env.DATABASE_URL = process.env.TEST_DATABASE_URL;
+  process.env.AUTH_SECRET = E2E_AUTH_SECRET;
+}