Expand e2e auth coverage, Vitest CI, and shared URL defaults

Wire viewer-frontend Vitest into Gitea Actions, centralize DEV base URLs
in env-defaults.json, expand playkit API catalog specs, and land auth/mail
flows plus verify-email public-host redirect and idle-logout e2e hooks.

e2e/tests/upload.smoke.spec.ts

@@ -0,0 +1,34 @@
+import { assertPublicHost, waitForUrlHost } from '@levkin/playkit';
+import { test, expect } from '../fixtures';
+
+test.describe('upload @smoke', () => {
+  test('authenticated user can open upload page', async ({
+    page,
+    playkitConfig,
+    loginPage,
+    e2eCredentials,
+    timings,
+  }) => {
+    test.skip(!e2eCredentials, 'E2E_ADMIN_EMAIL/PASSWORD required');
+    assertPublicHost(playkitConfig.baseUrl);
+
+    await timings.measure('login', async () => {
+      await loginPage.openLogin();
+      await loginPage.signIn(e2eCredentials!.email, e2eCredentials!.password);
+      await page.waitForURL((url) => !url.pathname.includes('/login'), { timeout: 30_000 });
+      await page.getByLabel('Account menu').waitFor({ state: 'visible', timeout: 30_000 });
+    });
+
+    await timings.measure('open_upload', async () => {
+      await page.goto(`${playkitConfig.baseUrl}/upload`);
+      await waitForUrlHost(page, playkitConfig.expectedHost);
+    });
+
+    expect(new URL(page.url()).pathname).toMatch(/\/upload/);
+    // Upload UI chrome
+    await expect(
+      page.getByText(/upload|drop|select|choose file|photos/i).first(),
+    ).toBeVisible({ timeout: 20_000 });
+    await expect(page.getByLabel('Account menu')).toBeVisible();
+  });
+});