Add Playwright e2e smoke tests + plug bugs that blocked them

[antosubash]

Summary

Adds two Chromium-driven smoke tests under tests/e2e/ plus the fixes needed to make them pass:

• test_login_and_browse_smoke — landing → Keycloak login → dashboard → products browse → logout. Minimal regression guard for the auth + render spine.
• test_products_crud_smoke — full create → edit → delete loop against the live products module.

Both are gated by the existing e2e pytest marker (excluded from make test, runnable via the new make test-e2e target).

Why

The repo already had Playwright and pytest-playwright in dev deps plus an e2e marker declared in pyproject.toml, but no browser-level coverage. The auth + CRUD spine spans a lot of code (AuthMiddleware, session cookies, the Keycloak OIDC flow, the Inertia resolver, the AuthenticatedLayout, RequiresPermission, module view endpoints, the sonner-toast UI) that the httpx-driven integration tests can't exercise. These two smoke tests are a quick, low-maintenance guard that catches broad breakage.

Collateral fixes

Bringing up a clean stack for the tests surfaced four pre-existing issues, all fixed here:

Fix	Where
Keycloak userinfo was missing realm_access.roles, so RequiresPermission("products.create") 403'd even for the seeded admin user	keycloak/realm-export.json — add oidc-usermodel-realm-role-mapper on the client
make migrate (cd host && ...) and make dev-api (from repo root) ended up targeting different SQLite files under a relative SM_DATABASE_URL	Makefile + host/alembic.ini — both run from the repo root now; script_location = %(here)s/migrations keeps alembic happy regardless of cwd
Once alembic.ini was usable from the repo root, the app's startup check_migrations started actually running (it silently no-op'd before) and broke 83 integration-test setups that used metadata.create_all and never stamped alembic_version	conftest.py — stamp at head after create_all; shared resolve_head_revision() helper in framework/hosting/simple_module_hosting/_migrations.py for check_migrations + the fixture
test_scaffolding_host.py had no explicit regression guard for the Vite 8 glob-path behavior upstream fixed in #21	add a small assertion that all emitted glob patterns are relative, not FS-absolute

Running locally

uv sync --all-packages
uv run playwright install chromium

make docker-up && make migrate && make dev   # one terminal
make test-e2e                                # another terminal

See docs/e2e-testing.md for env-var configuration (E2E_BASE_URL, E2E_USERNAME, E2E_PASSWORD) and headed-debug instructions.

Test plan

• make test-e2e → 2 passed
• make test (default, excludes e2e) → 328 passed
• ruff format --check ., ruff check ., ty check, biome ci ., check_file_size.py — all clean
• Verified the Keycloak realm-export import reproducibly adds realm_access.roles to userinfo (docker compose down keycloak && docker compose up -d keycloak → /auth/me returns realm_access.roles = ["admin","user"])