feat: add comprehensive E2E test suite (Playwright + WireGuard + API)

Adds tests/e2e/ with three layers of E2E coverage:
- API layer (tests/e2e/api/): unauthenticated access, admin endpoints,
  peer endpoints, access control enforcement — 24 tests
- Playwright UI (tests/e2e/ui/): login flows, admin navigation, peer
  dashboard/services, role-based ACL, password change — 60+ tests
- WireGuard connectivity (tests/e2e/wg/): tunnel up/down, DNS resolution
  through VPN, service ACL enforcement via iptables, full-tunnel routing
Shared helpers: PicAPIClient, WGInterface, playwright_login, cleanup.
Makefile targets: test-e2e-api, test-e2e-ui, test-e2e-wg, test-e2e.
Adds scripts/reset_admin_password.py for test bootstrap.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/reset_admin_password.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""Reset admin password directly in auth_users.json — for test environments only."""
+import sys
+import os
+import json
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'api'))
+
+
+def main():
+    if len(sys.argv) != 2:
+        print("Usage: reset_admin_password.py <new_password>", file=sys.stderr)
+        sys.exit(1)
+    new_password = sys.argv[1]
+    from auth_manager import AuthManager
+    data_dir = os.path.join(os.path.dirname(__file__), '..', 'data', 'api')
+    os.makedirs(data_dir, exist_ok=True)
+    mgr = AuthManager(data_dir=data_dir, config_dir='/tmp')
+    if mgr.set_password_admin('admin', new_password):
+        print(f"[OK] Admin password reset successfully.")
+    else:
+        print("[WARN] Admin user not found — creating admin user.")
+        mgr.create_user('admin', new_password, 'admin')
+        print(f"[OK] Admin user created with provided password.")
+
+
+if __name__ == '__main__':
+    main()