fix(ci): carry the failing spec's error into the e2e job summary (refs #161)

The per-spec table now has a "Why" column holding the spec's first error,
flattened for a markdown cell: ANSI stripped, newlines collapsed, `|` escaped
(a real report's message is multi-line, coloured, and embeds source-snippet
gutters), clipped to 300 chars. The column only appears when something failed.

So a red e2e names its cause in the summary even when the log is truncated or
the run is killed mid-stream — which is the state #161 was filed from.

Shape verified against an actual @playwright/test 1.61 failing report, not
just the fixture.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

infra/host-browser.yml

@@ -0,0 +1,20 @@
+# Overlay: make the CI compose stack usable from a HOST browser.
+# Same two mechanisms infra/docker-compose.local.yml already uses — pin Keycloak's issuer to the
+# host-published address, and point each portal's runtime config.json at it. The BFF needs no
+# change: it discovers metadata over keycloak:8080 and the discovered issuer is the pinned
+# localhost:8180, which is what browser tokens carry.
+services:
+  keycloak:
+    environment:
+      KC_HOSTNAME: http://localhost:8180
+      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
+  self-service:
+    volumes:
+      - ./local-config/self-service.config.json:/usr/share/nginx/html/config.json:ro,z
+  behandel:
+    volumes:
+      - ./local-config/behandel.config.json:/usr/share/nginx/html/config.json:ro,z
+  # beheer is the same medewerker realm as behandel, so it reuses behandel's config verbatim.
+  beheer:
+    volumes:
+      - ./local-config/behandel.config.json:/usr/share/nginx/html/config.json:ro,z