feat: add comprehensive E2E test suite (Playwright + WireGuard + API)

Adds tests/e2e/ with three layers of E2E coverage:
- API layer (tests/e2e/api/): unauthenticated access, admin endpoints,
  peer endpoints, access control enforcement — 24 tests
- Playwright UI (tests/e2e/ui/): login flows, admin navigation, peer
  dashboard/services, role-based ACL, password change — 60+ tests
- WireGuard connectivity (tests/e2e/wg/): tunnel up/down, DNS resolution
  through VPN, service ACL enforcement via iptables, full-tunnel routing
Shared helpers: PicAPIClient, WGInterface, playwright_login, cleanup.
Makefile targets: test-e2e-api, test-e2e-ui, test-e2e-wg, test-e2e.
Adds scripts/reset_admin_password.py for test bootstrap.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/e2e/helpers/admin_password.py

@@ -0,0 +1,16 @@
+import os
+
+
+def resolve_admin_password() -> str:
+    p = os.environ.get('PIC_ADMIN_PASS', '').strip()
+    if p:
+        return p
+    candidate = os.path.normpath(
+        os.path.join(os.path.dirname(__file__), '..', '..', '..', 'data', 'api', '.admin_initial_password')
+    )
+    if os.path.exists(candidate):
+        return open(candidate).read().strip()
+    raise RuntimeError(
+        "Admin password unknown. Set PIC_ADMIN_PASS env var or run: "
+        "make reset-test-admin-pass PIC_TEST_ADMIN_PASS=<password>"
+    )