Fix CI build/deploy/smoke pipeline for the self-hosted qa runner (#3)

## Summary
- Fix a chain of QA CI issues: Docker build/health-check flakiness, NuGet vuln pins, then adds the post-deploy integration + Playwright smoke suite and works through everything needed to make it actually run on the self-hosted `qa` runner (musl/Alpine job container, no node/dotnet/curl preinstalled, docker-outside-of-docker networking).
- Adds a fixed dev/QA seed admin user + fixed Development environment API key so integration tests and e2e specs have a stable target.
- Pins Aspire's `AppHost.cs` ports/credentials to match the docker-compose local dev defaults.
- Adds `tests/api/MicCheck.Api.Tests.Integration` coverage for disabled flags, environment-document bootstrap, identity override precedence, auth login, and unauthorized access; adds a Playwright e2e suite under `src/admin/e2e` (login, nav, context selection, features CRUD/toggle).
- Adds a `smoke-qa` CI job that runs both suites against the just-deployed QA stack, working around: no curl/node/dotnet on the bare runner, musl vs glibc (Playwright browsers run via the official `mcr.microsoft.com/playwright` image instead), and the runner's job-container network isolation (reach the QA stack via the docker bridge gateway IP; `docker cp` instead of a bind mount to get files into the playwright container, since paths don't cross the docker-outside-of-docker boundary).

## Test plan
- [x] Unit tests pass (dotnet test tests/api/MicCheck.Api.Tests.Unit, 243 passed)
- [x] API integration suite passes against the real QA stack in CI
- [x] Playwright e2e suite passes against the real QA stack in CI (verified 3/3 locally against a real dev API + vite server for the flakiest spec)
- [x] Full CI pipeline (build → deploy-qa → smoke-qa) green end to end on the qa runner

Reviewed-on: #3

tests/api/MicCheck.Api.Tests.Integration/Environments/EnvironmentDocumentTests.cs

@@ -0,0 +1,86 @@
+using System.Text.Json;
+using MicCheck.Api.Tests.Integration.Common;
+using MicCheck.Api.Tests.Integration.Flags;
+using NUnit.Framework;
+
+namespace MicCheck.Api.Tests.Integration.Environments;
+
+[TestFixture]
+public class EnvironmentDocumentTests
+{
+    private IntegrationTestSettings settings = null!;
+    private TestDatabase db = null!;
+    private FlagApiHttpClient client = null!;
+    private FlagSeed? seed;
+
+    [OneTimeSetUp]
+    public void OneTimeSetUp()
+    {
+        settings = IntegrationTestSettings.Load();
+        db = new TestDatabase(settings.DbConnectionString);
+        client = new FlagApiHttpClient(settings);
+    }
+
+    [OneTimeTearDown]
+    public void OneTimeTearDown() => client.Dispose();
+
+    [SetUp]
+    public async Task SetUp()
+        => seed = await FlagSeed.InsertEnabledFlagAsync(db, testRunTag: "EnvDocument", enabled: true, value: null);
+
+    [TearDown]
+    public async Task TearDown()
+    {
+        if (seed is not null)
+        {
+            await seed.CleanupAsync(db);
+            seed = null;
+        }
+    }
+
+    [Test]
+    public async Task WhenAnEnvironmentHasFeatureStates_ThenTheEnvironmentDocumentIncludesThem()
+    {
+        var current = seed!;
+
+        using var response = await client.SendAsync(
+            httpFile: "EnvironmentDocument.http",
+            requestName: "GetEnvironmentDocument",
+            variables: new Dictionary<string, string>
+            {
+                ["baseUrl"] = settings.BaseUrl,
+                ["environmentKey"] = current.EnvironmentApiKey
+            });
+
+        var body = await response.Content.ReadAsStringAsync();
+
+        Assert.That(
+            response.IsSuccessStatusCode,
+            Is.True,
+            $"GET /api/v1/environment-document returned {(int)response.StatusCode} {response.ReasonPhrase}. Body: {body}. DB state:\n{await current.DescribeAsync(db)}");
+
+        var document = JsonSerializer.Deserialize<EnvironmentDocumentDto>(body, JsonOptions)
+            ?? throw new InvalidOperationException("Response body was not the expected environment document shape.");
+
+        Assert.That(
+            document.Id,
+            Is.EqualTo(current.EnvironmentId),
+            $"Environment document Id did not match the seeded environment. DB state:\n{await current.DescribeAsync(db)}");
+
+        var match = document.FeatureStates.SingleOrDefault(f => f.Feature.Name == current.FeatureName);
+
+        Assert.That(
+            match,
+            Is.Not.Null,
+            $"Feature '{current.FeatureName}' was not present in the environment document. Returned features: [{string.Join(", ", document.FeatureStates.Select(f => f.Feature.Name))}]. DB state:\n{await current.DescribeAsync(db)}");
+
+        Assert.That(match!.Enabled, Is.True);
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web);
+
+    private sealed record EnvironmentDocumentDto(int Id, string ApiKey, List<FlagResponseDto> FeatureStates, EnvironmentProjectDto Project);
+    private sealed record EnvironmentProjectDto(int Id, string Name, List<object> Segments);
+    private sealed record FlagResponseDto(int Id, FeatureSummaryDto Feature, bool Enabled, string? FeatureStateValue);
+    private sealed record FeatureSummaryDto(int Id, string Name);
+}