devops: run the browser checks nightly

[landsman]

The e2e suite was local-only. make check boots the app but stops at the login page, so nothing in CI ever proved the app renders and behaves — the class of bug curl cannot see, and the reason CLAUDE.md opens with "debug the running app, do not guess".

A new e2e workflow, on its own:

• Nightly at 21:30 UTC — 23:30 in Prague through the summer, 22:30 once the clocks go back. GitHub cron is UTC, so the choice is which half of the year to be right in.
• Not per pull request. 15 checks, each booting a postgres, a server and a chromium, is minutes on every push to re-prove what the last run proved about code that mostly does not touch the UI.
• workflow_dispatch for when the answer is wanted now.
• The one pull_request trigger left is paths: [.github/workflows/e2e.yml] — a nightly that has never run is a nightly nobody knows is broken, so editing it runs it.
• ubuntu-24.04 only: the checks drive frankenphp and a headless chromium, never the native shell, so a second platform re-runs the same assertions at 10x.
• timeout-minutes: 20, and screenshots upload as an artifact on failure — there is no other way to see what the page looked like on a runner nobody was watching.

playwright install-deps is a separate step rather than part of mise run install: that task runs on developer machines and this one installs with sudo apt. It is not decorative — the runner only carries the libraries its own Chrome needs, and the step installs the rest.

Verified green on this branch in 2m01s, all 15 checks: https://github.com/landsman/adminer-desktop/actions/runs/30831009158

---

Fixed along the way, and unrelated to this file. Every workflow run had been failing at startup in 0s since ~14:40 UTC today — build.yml on the macos-codesign branch too, before this branch existed. The cause was not a workflow file: the repository's Actions policy had been set to local_only, "allow only actions defined in this repository", which rejects actions/checkout and everything else before a job starts. It is now an allow-list — GitHub-owned actions, plus jdx/mise-action@* and landsman/config/* (the reusable workflow claude-mentions.yml calls). A new third-party action needs an explicit entry, which is the point.