Browser E2E testing (a handful of critical journeys)

Drives real browser end-to-end tests (Playwright-style) over the few critical journeys on this Django/DRF plus Next.js stack — a storage-state auth fixture that logs in once and carries the HttpOnly cookie, the CSRF header on unsafe methods, per-test tenant-scoped seed data, and a negative authorization assertion that a user without the role is actually blocked. Use when adding or fixing an E2E spec, wiring the login/storage-state fixture, choosing which journeys deserve a browser test, debugging a flaky or order-dependent spec, or running the browser suite against a real server in CI. Not for unit or integration tests (see write-tests) or manually driving one change to c…