test: cover captcha env fallback, cache TTLs and public e2e flows

- unit: captcha env fallback/precedence (DB wins, explicit "none") and
  perf-ttls defaults, overrides and invalid values
- e2e: public page render + image health, register form and Turnstile
  widget consistency, anonymous auth-guard redirects, plus warm latency
  budgets and cache-control contracts

e2e/public-pages.spec.ts

@@ -0,0 +1,46 @@
+import { expect, test } from "@playwright/test";
+import {
+	expectNoApplicationError,
+	expectNoBrokenImages,
+	expectNoHorizontalOverflow,
+	scrollThroughPage,
+} from "./helpers";
+
+// Read-only smoke coverage for the anonymous-facing pages: each must return a
+// real document, render without an error boundary, and load every image. This
+// is where a missing upload, a bad avatar figure or a broken theme asset shows
+// up — none of which the unit suite can catch.
+const PUBLIC_ROUTES = [
+	"/",
+	"/news",
+	"/staff",
+	"/shop",
+	"/search",
+	"/leaderboard",
+	"/help",
+	"/radio",
+] as const;
+
+for (const route of PUBLIC_ROUTES) {
+	test(`${route} renders, loads its images and does not overflow`, async ({
+		page,
+	}) => {
+		const response = await page.goto(route);
+		expect(response?.ok(), `GET ${route} -> ${response?.status()}`).toBe(true);
+
+		await expect(page.locator("main").first()).toBeVisible();
+		await expectNoApplicationError(page);
+
+		await scrollThroughPage(page);
+		await expectNoBrokenImages(page);
+		await expectNoHorizontalOverflow(page);
+	});
+}
+
+test("the homepage stays usable on a narrow viewport", async ({ page }) => {
+	await page.setViewportSize({ width: 390, height: 844 });
+	const response = await page.goto("/");
+	expect(response?.ok()).toBe(true);
+	await expectNoApplicationError(page);
+	await expectNoHorizontalOverflow(page);
+});