Expand e2e auth coverage, Vitest CI, and shared URL defaults

Wire viewer-frontend Vitest into Gitea Actions, centralize DEV base URLs
in env-defaults.json, expand playkit API catalog specs, and land auth/mail
flows plus verify-email public-host redirect and idle-logout e2e hooks.

e2e/tests/api.auth.spec.ts

@@ -0,0 +1,18 @@
+import { test, expect } from '../fixtures';
+
+test.describe('api auth @smoke', () => {
+  test('protected /api/v1/auth/me returns 401 without token', async ({ api, timings }) => {
+    const res = await timings.measure('api_me_unauth', () =>
+      api.get('/api/v1/auth/me', { expectedStatus: 401 }),
+    );
+    expect(res.status).toBe(401);
+    expect(res.data).toMatchObject({ detail: expect.stringMatching(/not authenticated/i) });
+  });
+
+  test('protected /api/v1/photos returns 401 without token', async ({ api, timings }) => {
+    const res = await timings.measure('api_photos_unauth', () =>
+      api.get('/api/v1/photos', { expectedStatus: 401 }),
+    );
+    expect(res.status).toBe(401);
+  });
+});