Add integration + Playwright smoke suite for post-deploy QA validation

Existing coverage was one integration test and zero e2e tests. Adds the thin,
high-value integration/e2e layer unit tests can't reach (real Postgres wire
contract, real browser flows) and wires it as a post-deploy smoke gate.

- Seed a deterministic dev/QA admin user and fixed Development env key so
  HTTP-only tests can authenticate without per-run registration.
- Expand the API integration suite: disabled-flag, unauthorized access,
  environment-document bootstrap, identity-override precedence, and auth
  login scenarios, reusing the existing black-box HTTP+Npgsql harness.
- Add a Playwright suite for the admin SPA: login, nav, project/environment
  context selection, and feature create/toggle, against the real API.
- Bind QA Postgres to 127.0.0.1 for direct seeding, add smoke-qa.sh and an
  ensure_node() bootstrap (the qa runner has no Node today), and wire a new
  smoke-qa CI job after deploy-qa.

deploy/qa/docker-compose.qa.yml

@@ -1,8 +1,10 @@
 name: miccheck-qa
 
 # Dedicated, network-isolated QA stack. Not connected to the dev compose
-# stack's network - runs entirely on its own bridge network below, and the
-# database has no published host port.
+# stack's network - runs entirely on its own bridge network below. The API has
+# no published host port; Postgres is bound to 127.0.0.1 only, so the smoke-qa
+# CI job (running on this same host) can seed/inspect data directly while it
+# stays unreachable off-box.
 services:
 
   db:
@@ -11,6 +13,8 @@ services:
       POSTGRES_DB: miccheck
       POSTGRES_USER: miccheck
       POSTGRES_PASSWORD: password
+    ports:
+      - "127.0.0.1:55432:5432"
     volumes:
       - miccheck-qa-pgdata:/var/lib/postgresql/data
     networks: