ci: run e2e smoke against deployed app and ignore playwright artifacts

- Add e2e job (needs deploy, main/master only) that installs the
  Playwright browser and smoke-tests the live container on :3002
- Keep deploy-job contract slice from bleeding into the e2e job
- Cover the e2e job in the CI workflow contract test
- Ignore Playwright output dirs (test-results, playwright-report,
  blob-report)

.gitea/workflows/ci.yaml

@@ -158,3 +158,31 @@ jobs:
           docker rm epicnext-cms-app 2>/dev/null || true
           docker compose -f /var/www/atom-nexst/docker-compose.yml up -d --no-build 2>&1 || true
           exit 1
+
+  # ─────────────────────────────────────────────
+  # E2E smoke against the freshly deployed container.
+  # Runs after a successful deploy on main/master only
+  # (on PRs the deploy job is skipped, so this is skipped too).
+  # Public read-only endpoints only — safe against production.
+  # ─────────────────────────────────────────────
+  e2e:
+    needs: deploy
+    if: gitea.event_name == 'push' && (gitea.ref_name == 'main' || gitea.ref_name == 'master')
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ gitea.repository }}
+          token: ${{ gitea.token }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Playwright browser
+        run: pnpm exec playwright install chromium
+
+      - name: Smoke test deployed app
+        env:
+          PLAYWRIGHT_BASE_URL: "http://127.0.0.1:3002"
+        run: pnpm test:e2e