Expand e2e auth coverage, Vitest CI, and shared URL defaults

Wire viewer-frontend Vitest into Gitea Actions, centralize DEV base URLs
in env-defaults.json, expand playkit API catalog specs, and land auth/mail
flows plus verify-email public-host redirect and idle-logout e2e hooks.

.gitea/workflows/ci.yml

@@ -5,9 +5,12 @@ name: CI
 
 on:
   push:
-    branches: [master, main]
+    branches: [master, main, dev]
   pull_request:
     types: [opened, synchronize, reopened]
+  # Daily DEV smoke (~06:00 America/Toronto)
+  schedule:
+    - cron: '0 10 * * *'
 
 jobs:
   skip-ci-check:
@@ -68,6 +71,30 @@ jobs:
           docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:latest \
             detect --source /repo --no-banner --redact ${extra}
 
+  # Vitest unit tests (viewer-frontend) — landed in PR #63, wired here.
+  viewer-unit:
+    needs: skip-ci-check
+    if: needs.skip-ci-check.outputs.should-skip != '1'
+    runs-on: [homelab, self-hosted, linux]
+    defaults:
+      run:
+        working-directory: viewer-frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: viewer-frontend/package-lock.json
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Run Vitest
+        run: npm test
+
   # Playwright smoke via @levkin/playkit — public host guards + API health.
   # Sign-out auth spec runs only when E2E_ADMIN_* secrets are present.
   e2e:
@@ -86,9 +113,9 @@ jobs:
           node-version: '20'
 
       - name: Allow private playkit clone
-        if: ${{ secrets.GITEA_TOKEN != '' }}
+        if: ${{ secrets.PLAYKIT_GIT_TOKEN != '' }}
         run: |
-          git config --global url."https://oauth2:${{ secrets.GITEA_TOKEN }}@git.levkin.ca/".insteadOf "https://git.levkin.ca/"
+          git config --global url."https://oauth2:${{ secrets.PLAYKIT_GIT_TOKEN }}@git.levkin.ca/".insteadOf "https://git.levkin.ca/"
 
       - name: Install e2e deps
         run: npm ci
@@ -107,10 +134,17 @@ jobs:
           MAILTRAP_API_TOKEN: ${{ secrets.MAILTRAP_API_TOKEN }}
           MAILTRAP_ACCOUNT_ID: ${{ secrets.MAILTRAP_ACCOUNT_ID }}
           MAILTRAP_INBOX_ID: ${{ secrets.MAILTRAP_INBOX_ID }}
+          PLAYKIT_MAIL_PROVIDER: ${{ secrets.PLAYKIT_MAIL_PROVIDER }}
+          MAILPIT_BASE_URL: ${{ secrets.MAILPIT_BASE_URL }}
+          MAILPIT_USER: ${{ secrets.MAILPIT_USER }}
+          MAILPIT_PASSWORD: ${{ secrets.MAILPIT_PASSWORD }}
           CI: 'true'
         run: |
-          export PLAYKIT_BASE_URL="${PLAYKIT_BASE_URL:-https://punimtagdev.levkin.ca}"
-          export PLAYKIT_API_BASE_URL="${PLAYKIT_API_BASE_URL:-http://10.0.10.121:8000}"
+          # Fallbacks from e2e/env-defaults.json (single source of truth with TS)
+          DEFAULT_BASE_URL=$(node -p "require('./env-defaults.json').DEFAULT_BASE_URL")
+          DEFAULT_API_BASE_URL=$(node -p "require('./env-defaults.json').DEFAULT_API_BASE_URL")
+          export PLAYKIT_BASE_URL="${PLAYKIT_BASE_URL:-$DEFAULT_BASE_URL}"
+          export PLAYKIT_API_BASE_URL="${PLAYKIT_API_BASE_URL:-$DEFAULT_API_BASE_URL}"
           npx playwright test
 
       - name: Upload report