test(e2e): walking-skeleton Playwright happy path + verify-e2e lane (refs #68)

tests/e2e Playwright spec drives DigiD login (jan-burger/test123) → submit →
confirmation against the compose-served portal. run-e2e-check.sh runs it inside the
compose network (node container, browser installed at runtime) so the token issuer
(keycloak:8080) matches the BFF authority (ADR-0010). Wired as verify-e2e (Makefile +
verify chain + a verify-stack CI step).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/e2e/registration.spec.ts

@@ -0,0 +1,21 @@
+import { expect, test } from '@playwright/test';
+
+// Walking-skeleton happy path (S-08d): a zorgprofessional logs in via mock DigiD and submits a
+// registration through the self-service portal → BFF → domain. The confirmation shows the reference.
+test('DigiD login → submit → confirmation', async ({ page }) => {
+  // Visiting the guarded page redirects to the Keycloak (mock DigiD) login.
+  await page.goto('/');
+
+  // Keycloak's default login form (stable ids across themes).
+  await page.locator('#username').fill('jan-burger');
+  await page.locator('#password').fill('test123');
+  await page.locator('#kc-login').click();
+
+  // Back on the portal, authenticated.
+  await expect(page.getByRole('heading', { name: /Zelfservice/i })).toBeVisible();
+
+  await page.getByRole('button', { name: /indienen/i }).click();
+
+  // The BFF accepted it and the page shows the confirmation.
+  await expect(page.getByText(/ontvangen/i)).toBeVisible();
+});