test(ci): deterministic deploy gate + advisory quality suite; sync README versions

The deploy gate ran e2e specs that depend on live content and data, so a missing
upload (the /help article images) or a legacy malformed avatar figure could turn
a safe code deploy red. Split the suites by what they actually guarantee:

- Blocking gate (`pnpm test:e2e`, `playwright.config.ts`): only checks the CMS
  can guarantee itself — anonymous redirects, register form fields, the captcha
  DOM contract and the cache-control headers (deterministic origin-direct).
- Advisory suite (`pnpm test:e2e:quality`, `playwright.quality.config.ts`):
  broken images, layout overflow and warm-page latency, which depend on live
  content/upload state and the host. It runs as a `continue-on-error` CI job
  against the public site so a real content problem stays visible without
  blocking the pipeline.

Also add `scripts/sync-readme-versions.mjs` (+ tests, docs and a CI check) so
the pinned versions in README.md can never drift from package.json / .nvmrc.

e2e/quality/content-health.spec.ts

@@ -3,13 +3,16 @@ import {
 	expectNoApplicationError,
 	expectNoBrokenImages,
 	expectNoHorizontalOverflow,
+	isMaintenanceRedirect,
 	scrollThroughPage,
-} from "./helpers";
+} from "../helpers";
 
-// Read-only smoke coverage for the anonymous-facing pages: each must return a
-// real document, render without an error boundary, and load every image. This
-// is where a missing upload, a bad avatar figure or a broken theme asset shows
-// up — none of which the unit suite can catch.
+// ADVISORY suite — run with `pnpm test:e2e:quality`, not part of the deploy
+// gate. These checks depend on live content/upload state and user data (a
+// missing upload, a legacy malformed avatar figure, a bad theme asset), so
+// they are informational: they tell you the site has a real content problem,
+// but they must never block a code deploy. Every assertion the CMS can
+// guarantee on its own lives in the blocking specs instead.
 const PUBLIC_ROUTES = [
 	"/",
 	"/news",
@@ -22,9 +25,7 @@ const PUBLIC_ROUTES = [
 ] as const;
 
 for (const route of PUBLIC_ROUTES) {
-	test(`${route} renders, loads its images and does not overflow`, async ({
-		page,
-	}) => {
+	test(`${route} loads every image and does not overflow`, async ({ page }) => {
 		const response = await page.goto(route);
 		expect(response?.ok(), `GET ${route} -> ${response?.status()}`).toBe(true);
 
@@ -37,6 +38,17 @@ for (const route of PUBLIC_ROUTES) {
 	});
 }
 
+test("the register page loads its theme/avatar images", async ({ page }) => {
+	const response = await page.goto("/register");
+	test.skip(
+		isMaintenanceRedirect(page.url()) || response?.status() === 404,
+		"register is not reachable on this deploy",
+	);
+	await scrollThroughPage(page);
+	await expectNoBrokenImages(page);
+	await expectNoHorizontalOverflow(page);
+});
+
 test("the homepage stays usable on a narrow viewport", async ({ page }) => {
 	await page.setViewportSize({ width: 390, height: 844 });
 	const response = await page.goto("/");

e2e/quality/performance.spec.ts

@@ -0,0 +1,24 @@
+import { expect, test } from "@playwright/test";
+
+// ADVISORY suite — run with `pnpm test:e2e:quality`. Warm-page latency depends
+// on the host, the edge and the shared data caches, so a slow CI hop can trip
+// these budgets without anything being wrong. The cache-control *contract*
+// (deterministic) lives in the blocking `e2e/performance.spec.ts`; only the
+// timing budgets are advisory.
+const BUDGET_MS = Number(process.env.E2E_LOAD_BUDGET_MS || 4000);
+
+const WARM_ROUTES = ["/", "/news", "/staff", "/shop", "/login", "/register"];
+
+for (const route of WARM_ROUTES) {
+	test(`${route} responds within the warm budget`, async ({ request }) => {
+		await request.get(route); // warm the render + data caches
+		const started = Date.now();
+		const response = await request.get(route);
+		const elapsed = Date.now() - started;
+		expect([200, 304]).toContain(response.status());
+		expect(
+			elapsed,
+			`GET ${route} took ${elapsed}ms (budget ${BUDGET_MS}ms)`,
+		).toBeLessThan(BUDGET_MS);
+	});
+}