Expand e2e auth coverage, Vitest CI, and shared URL defaults

Wire viewer-frontend Vitest into Gitea Actions, centralize DEV base URLs
in env-defaults.json, expand playkit API catalog specs, and land auth/mail
flows plus verify-email public-host redirect and idle-logout e2e hooks.

e2e/tests/admin.manage-users.spec.ts

@@ -0,0 +1,40 @@
+import { assertPublicHost, waitForUrlHost } from '@levkin/playkit';
+import { test, expect } from '../fixtures';
+
+/**
+ * Kolby #57 class: Manage Users overlay must close cleanly before sign-out
+ * and the post-logout URL must stay on the public host.
+ */
+test.describe('admin users @smoke', () => {
+  test('manage users then sign-out stays on public host', async ({
+    page,
+    playkitConfig,
+    loginPage,
+    accountMenu,
+    e2eCredentials,
+    timings,
+  }) => {
+    test.skip(!e2eCredentials, 'E2E_ADMIN_EMAIL/PASSWORD required (admin user)');
+    assertPublicHost(playkitConfig.baseUrl);
+
+    await timings.measure('login', async () => {
+      await loginPage.openLogin();
+      await loginPage.signIn(e2eCredentials!.email, e2eCredentials!.password);
+      await page.waitForURL((url) => !url.pathname.includes('/login'), { timeout: 30_000 });
+      await page.getByLabel('Account menu').waitFor({ state: 'visible', timeout: 30_000 });
+    });
+
+    await timings.measure('manage_users', async () => {
+      await accountMenu.openManageUsers();
+      await expect(page.getByRole('heading', { name: /Manage Users/i })).toBeVisible();
+      await accountMenu.closeManageUsers();
+    });
+
+    await timings.measure('sign_out', () => accountMenu.signOut());
+    await waitForUrlHost(page, playkitConfig.expectedHost);
+    expect(page.url()).not.toMatch(/10\.\d+\.\d+\.\d+/);
+    await expect(page.getByRole('button', { name: /Sign in/i })).toBeVisible({
+      timeout: 15_000,
+    });
+  });
+});