test(imaging): add endpoint contract e2e and cross-browser render checks

The deploy gate only installs chromium, so imaging had no browser-level
coverage. Add two Playwright specs:

- e2e/imaging/avatar-endpoint.spec.ts: HTTP contract for the avatar
  (/api/imaging/avatar), default (/imaging) and badge endpoints — animated
  APNG for a figure with an effect, the trailing-`.0` regression figure,
  ETag/304 revalidation, and a 400 for a malformed figure. Runs in the
  deploy gate automatically via the default Playwright config.
- e2e/imaging/avatar-render.spec.ts: loads the avatar in a real browser and
  asserts it decodes at a non-zero size and animates. Navigates to the image
  URL directly so production CSP `upgrade-insecure-requests` cannot rewrite
  the request over a plain-HTTP host.

Add playwright.imaging.config.ts running both across chromium, firefox and
webkit, a `test:imaging` script, and a non-blocking CI job that installs all
three engines and checks the live site.

playwright.imaging.config.ts

@@ -0,0 +1,34 @@
+import { defineConfig, devices } from "@playwright/test";
+
+// Cross-browser imaging checks. Unlike the main e2e config (chromium only,
+// used as the deploy gate), this runs the same specs across every bundled
+// engine so an avatar format that only one browser can decode is caught.
+//
+// Point it at a running CMS with PLAYWRIGHT_BASE_URL (defaults to the local
+// host port). Requires all three engines: `pnpm exec playwright install
+// chromium firefox webkit`.
+const baseURL = process.env.PLAYWRIGHT_BASE_URL || "http://127.0.0.1:3002";
+
+export default defineConfig({
+	testDir: "./e2e/imaging",
+	fullyParallel: false,
+	workers: 1,
+	retries: 1,
+	timeout: 60000,
+	expect: { timeout: 15000 },
+	reporter: [
+		["list"],
+		["html", { outputFolder: "playwright-report/imaging", open: "never" }],
+	],
+	outputDir: "test-results/imaging",
+	use: {
+		baseURL,
+		trace: "retain-on-failure",
+		screenshot: "only-on-failure",
+	},
+	projects: [
+		{ name: "chromium", use: { ...devices["Desktop Chrome"] } },
+		{ name: "firefox", use: { ...devices["Desktop Firefox"] } },
+		{ name: "webkit", use: { ...devices["Desktop Safari"] } },
+	],
+});