test: cover captcha env fallback, cache TTLs and public e2e flows

- unit: captcha env fallback/precedence (DB wins, explicit "none") and
  perf-ttls defaults, overrides and invalid values
- e2e: public page render + image health, register form and Turnstile
  widget consistency, anonymous auth-guard redirects, plus warm latency
  budgets and cache-control contracts

e2e/performance.spec.ts

@@ -0,0 +1,47 @@
+import { expect, test } from "@playwright/test";
+
+// Latency + caching contract for the anonymous pages. The perf work relies on
+// the edge/shared cache (`src/proxy.ts`): public content pages advertise a
+// short `s-maxage`, while session-dependent pages (login, register, settings)
+// must stay `private, no-store`. Budgets are deliberately loose so a cold
+// cache or a slow CI hop does not flap the gate.
+const BUDGET_MS = Number(process.env.E2E_LOAD_BUDGET_MS || 4000);
+
+const WARM_ROUTES = ["/", "/news", "/staff", "/shop", "/login", "/register"];
+
+for (const route of WARM_ROUTES) {
+	test(`${route} responds within the warm budget`, async ({ request }) => {
+		await request.get(route); // warm the render + data caches
+		const started = Date.now();
+		const response = await request.get(route);
+		const elapsed = Date.now() - started;
+		expect([200, 304]).toContain(response.status());
+		expect(
+			elapsed,
+			`GET ${route} took ${elapsed}ms (budget ${BUDGET_MS}ms)`,
+		).toBeLessThan(BUDGET_MS);
+	});
+}
+
+test("anonymous content pages advertise a shared cache", async ({
+	request,
+}) => {
+	for (const route of ["/news", "/staff", "/shop"]) {
+		const response = await request.get(route);
+		const cacheControl = response.headers()["cache-control"] ?? "";
+		expect(cacheControl, `GET ${route} cache-control`).toContain("s-maxage");
+	}
+});
+
+test("session-dependent pages stay private and uncached", async ({
+	request,
+}) => {
+	for (const route of ["/login", "/register"]) {
+		const response = await request.get(route);
+		const cacheControl = response.headers()["cache-control"] ?? "";
+		expect(cacheControl, `GET ${route} cache-control`).toContain("no-store");
+		expect(cacheControl, `GET ${route} must not be shared`).not.toContain(
+			"s-maxage",
+		);
+	}
+});