fix(e2e): treat the http portal origin as secure so DigiD PKCE login works (refs #68)

The walking-skeleton e2e timed out waiting for the Keycloak login form
(`#username`). Root cause: in the compose network the portal is served over
plain HTTP on a non-localhost origin (http://self-service), which is not a
secure context, so Web Crypto (`crypto.subtle`) is undefined. angular-auth-
oidc-client needs SubtleCrypto to build the PKCE code challenge, so
`authorize()` threw ("Cannot read properties of undefined (reading 'digest')")
and the login redirect never fired.

Production serves the portal over HTTPS, where this works. Instead of
terminating TLS in the throwaway e2e stack, tell Chromium to treat the origin
as secure via --unsafely-treat-insecure-origin-as-secure. The flag is only
honoured by the full Chromium build (new headless), not Playwright's default
headless-shell, so pin channel: 'chromium'.

Verified against a minimal in-network stack (keycloak + self-service): login
redirect now reaches the Keycloak form, and the full login → token exchange →
authenticated portal renders with no console errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/e2e/playwright.config.ts

@@ -2,6 +2,8 @@ import { defineConfig, devices } from '@playwright/test';
 
 // The e2e runs inside the compose network (infra/run-e2e-check.sh); baseURL defaults to the
 // self-service service. Keep timeouts generous — the first navigation triggers the DigiD flow.
+const baseURL = process.env.SELF_SERVICE_URL ?? 'http://self-service';
+
 export default defineConfig({
   testDir: '.',
   timeout: 90_000,
@@ -9,8 +11,18 @@ export default defineConfig({
   retries: 1,
   reporter: [['list']],
   use: {
-    baseURL: process.env.SELF_SERVICE_URL ?? 'http://self-service',
+    baseURL,
     trace: 'on-first-retry',
+    // The portal is served over plain HTTP on a non-localhost origin (http://self-service) inside the
+    // compose network, so it is NOT a secure context — and Web Crypto (`crypto.subtle`) is undefined
+    // there. angular-auth-oidc-client needs SubtleCrypto to build the PKCE code challenge, so
+    // `authorize()` throws and the login redirect never fires (the login form never appears). In
+    // production the portal runs behind HTTPS, where this works. Rather than terminate TLS in the
+    // throwaway e2e stack, tell Chromium to treat this origin as secure — which faithfully emulates
+    // the production HTTPS context. This flag is only honoured by the full Chromium build (new
+    // headless), not Playwright's default headless-shell, so pin `channel: 'chromium'`.
+    channel: 'chromium',
+    launchOptions: { args: [`--unsafely-treat-insecure-origin-as-secure=${baseURL}`] },
   },
   projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],
 });