test(imaging): add endpoint contract e2e and cross-browser render checks

The deploy gate only installs chromium, so imaging had no browser-level
coverage. Add two Playwright specs:

- e2e/imaging/avatar-endpoint.spec.ts: HTTP contract for the avatar
  (/api/imaging/avatar), default (/imaging) and badge endpoints — animated
  APNG for a figure with an effect, the trailing-`.0` regression figure,
  ETag/304 revalidation, and a 400 for a malformed figure. Runs in the
  deploy gate automatically via the default Playwright config.
- e2e/imaging/avatar-render.spec.ts: loads the avatar in a real browser and
  asserts it decodes at a non-zero size and animates. Navigates to the image
  URL directly so production CSP `upgrade-insecure-requests` cannot rewrite
  the request over a plain-HTTP host.

Add playwright.imaging.config.ts running both across chromium, firefox and
webkit, a `test:imaging` script, and a non-blocking CI job that installs all
three engines and checks the live site.

.gitea/workflows/ci.yaml

@@ -116,6 +116,34 @@ jobs:
             test-results/ui/
           retention-days: 14
 
+  # Cross-browser imaging: the deploy gate only runs chromium, so this verifies
+  # a real render (decode + APNG animation) across every bundled engine against
+  # the public site. Non-blocking: it hits the live service, so transient
+  # network/edge hiccups must not fail the pipeline; the blocking contract
+  # checks live in the deploy gate (e2e/imaging/avatar-endpoint.spec.ts).
+  tests-imaging-browsers:
+    needs: check
+    if: gitea.event_name == 'push' && (gitea.ref_name == 'main' || gitea.ref_name == 'master')
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          repository: ${{ gitea.repository }}
+          token: ${{ gitea.token }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install cross-browser engines
+        run: pnpm exec playwright install --with-deps chromium firefox webkit
+
+      - name: Cross-browser imaging checks
+        env:
+          PLAYWRIGHT_BASE_URL: https://epicnabbo.nl
+        run: pnpm test:imaging
+
   preflight:
     needs: [tests-unit, tests-integration, tests-ui]
     if: gitea.event_name == 'pull_request' || (gitea.event_name == 'push' && startsWith(gitea.ref, 'refs/heads/codex/'))