test: run integration tests against the real nginx image

[oto-macenauer-absa]

Stacked on #59. Branched off fix/deployment-headers-and-image because it needs nginx.headers.conf and the unprivileged Dockerfile. The diff below narrows to just this work once #59 merges.

What

Nothing in CI has ever executed nginx.conf. Both existing suites run against tests/fragment-server.mjs — a hand-written Express mirror of the nginx rewrites. A mirror is only as faithful as the last person to remember to update both sides, and this one had already drifted twice:

• It sent no response headers at all, so the two X-Frame-Options tests in standalone.spec.js were passing against a server that could not have failed them. That is part of why Security: nginx location blocks silently drop every inherited CORS and security header #45 lived as long as it did.
• It answered /knowledge-base with a 308, where nginx.conf deliberately does an internal rewrite — the config comment says a redirect would expose the container's internal HTTP address and break mixed-content under HTTPS (The Express nginx mirror contradicts production on the no-trailing-slash rule #60).

So the suites were partly asserting against a second implementation of the contract rather than the contract.

Changes

playwright.config.docker.js + tests/container/serve.mjs + tests/container.spec.js — a fourth suite that builds and runs the production image and drives it over HTTP. 21 tests covering:

• routing: /healthz, landing, sub-app page, /__wf/…/style.css rewrite, 404s, OPTIONS → 204
• the internal-rewrite rule, asserted with maxRedirects: 0 — status 200 and no Location header
• the full CORS + security set on six paths, which is the Security: nginx location blocks silently drop every inherited CORS and security header #45 guard against the shipped config rather than against config text
• container posture: uid=101(nginx), no root process, nginx -t valid

npm run test:container, wired into the existing image CI job via KB_SKIP_BUILD so the image is built once and reused.

tests/fragment-server.mjs — mirror corrected (#60).

playwright.config.js — testIgnore now excludes container.spec.js too; it was being picked up by the embedded suite and run against the wrong server.

Why not testcontainers

Considered, and it does not earn its place here:

• One container. No dependency graph, no database fixtures, no dynamic wiring — that is the case testcontainers exists for.
• The image already exposes /healthz and has a HEALTHCHECK, so the wait strategy is a URL poll, which Playwright's webServer does natively.
• It pulls a Ryuk sidecar — an extra moving part in a repo whose stated virtue is a dependency-light, hermetic build (one runtime dependency, ajv).
• The repo already hand-rolls its test servers (fragment-server.mjs, host/server.mjs); a ~60-line serve.mjs matches that.

Its genuine wins are random ports and guaranteed cleanup on crash. Ports are fixed here the way :3000 and :4201 already are, and cleanup is a docker rm -f in three signal handlers.

Found while building it

Probing real nginx turned up a wider version of #60 than the issue described. try_files $uri $uri/index.html serves a directory path as its index with a 200 whether or not it ends in a slash, and never redirects:

path	nginx	mirror (before)
/knowledge-base	200	301
/knowledge-base/user-guide	200	301

express.static answers 301 for a slash-less directory by default. So the mirror was redirecting on every sub-app path, not just the one the issue named. Fixed with redirect: false plus an explicit $uri/index.html fallback, and both suites now assert the no-redirect contract on both paths.

This is exactly the class of thing the suite exists to find, on its first run.

Verification

npm run test:container                                → 21 passed  (new; cold build from scratch)
npx playwright test --config=playwright.config.ci.js  → 22 passed  (was 20; +2)
npm test                                              → 57 passed

Scope limit

This verifies nginx faithfully. It does not cover the web-fragments gateway in front of it in production — that remains the embedded harness's job. It closes the mirror-drift gap, not the whole deployment path.

Closes #60