test: FastAPI e2e role-permission gates + gallery search filter coverage

- Wire E2E_API_USERNAME/PASSWORD (admin) + E2E_API_VIEWER_USERNAME/PASSWORD
  (viewer) into the Gitea Actions e2e job so FastAPI-authed specs run in CI.
- Add api.role-permissions.spec.ts: viewer 403 vs admin 200/200/200 on
  /api/v1/users, /api/v1/role-permissions, and /api/v1/photos/bulk-delete
  (safe no-op via a non-existent photo id — proves the gate, not deletion).
- Add gallery.search-filters.spec.ts: tag_id and person_id filters on the
  public /api/search route return correct subsets, combined filters narrow
  results, and the /search UI tag-filter interaction updates the URL/count.
- Update ROADMAP/README/.env.example for the new env vars and coverage.

.gitea/workflows/ci.yml

@@ -131,6 +131,12 @@ jobs:
           PLAYKIT_ENV: dev
           E2E_ADMIN_EMAIL: ${{ secrets.E2E_ADMIN_EMAIL }}
           E2E_ADMIN_PASSWORD: ${{ secrets.E2E_ADMIN_PASSWORD }}
+          # FastAPI main-DB bearer creds (separate store from NextAuth above) —
+          # admin mirrors e2e@levkine.ca; viewer is role-gate test coverage only.
+          E2E_API_USERNAME: ${{ secrets.E2E_API_USERNAME }}
+          E2E_API_PASSWORD: ${{ secrets.E2E_API_PASSWORD }}
+          E2E_API_VIEWER_USERNAME: ${{ secrets.E2E_API_VIEWER_USERNAME }}
+          E2E_API_VIEWER_PASSWORD: ${{ secrets.E2E_API_VIEWER_PASSWORD }}
           MAILTRAP_API_TOKEN: ${{ secrets.MAILTRAP_API_TOKEN }}
           MAILTRAP_ACCOUNT_ID: ${{ secrets.MAILTRAP_ACCOUNT_ID }}
           MAILTRAP_INBOX_ID: ${{ secrets.MAILTRAP_INBOX_ID }}