ADR-0043: One Playwright configuration against the portal on port 3000

Status: Accepted (WP-70e). Implemented in apps/web/playwright.config.ts, apps/web/e2e/{env,session}.ts.

Context

The three page work packages ran their Playwright specs against private web servers on ports 3031–3033 with their own build directories. Because the API accepts state-changing requests only from server.public_url (port 3000), the specs rewrote Origin headers, mocked sessions and used per-package helpers. Sign-in is rate limited (5 per account per 15 minutes), so suites that signed in repeatedly failed intermittently.

Decision

One configuration and one suite: pnpm e2e runs every spec against next start on port 3000 (started by the configuration, or an existing server, or E2E_BASE_URL), in six projects: 375, 768 and 1280 px, each in light and dark.
Each account signs in once; the session cookies are cached on disk and shared by workers and runs, and validated with GET /auth/session before reuse.
Each test's browser context sends its own X-Forwarded-For from a documentation range, so per-address limits apply per test. This works against the development API, which trusts 127.0.0.1; a stack must trust the web container for it (ADR-0040).
New flows create what they change (a fresh reporter, a fresh OpenVEX statement, a fresh applicant) and set settings back; specs that act on seeded findings, tasks and appeals assert the state they leave, so the suite re-runs without re-seeding.
Flows that change shared data run once (1280 px, light); keyboard-only checks skip at 375 px.

Consequences

The whole suite ran green locally against the seeded development backend: 1080 tests, 993 passed, 87 skipped by design, 0 failed (WP-70e, 2026-11-10). It has not run on a GitHub runner: the e2e workflow's only run (a Dependabot pull request) failed before any test, and the workflow has been changed since.
The suite depends on the development seed; it is not a test of an empty installation.