test: FastAPI e2e role-permission gates + gallery search filter coverage

- Wire E2E_API_USERNAME/PASSWORD (admin) + E2E_API_VIEWER_USERNAME/PASSWORD
  (viewer) into the Gitea Actions e2e job so FastAPI-authed specs run in CI.
- Add api.role-permissions.spec.ts: viewer 403 vs admin 200/200/200 on
  /api/v1/users, /api/v1/role-permissions, and /api/v1/photos/bulk-delete
  (safe no-op via a non-existent photo id — proves the gate, not deletion).
- Add gallery.search-filters.spec.ts: tag_id and person_id filters on the
  public /api/search route return correct subsets, combined filters narrow
  results, and the /search UI tag-filter interaction updates the URL/count.
- Update ROADMAP/README/.env.example for the new env vars and coverage.

e2e/.env.example

@@ -9,9 +9,14 @@ PLAYKIT_ENV=dev
 E2E_ADMIN_EMAIL=
 E2E_ADMIN_PASSWORD=
 
-# Optional FastAPI bearer tests (separate user DB from NextAuth)
+# Optional FastAPI bearer tests (separate user DB from NextAuth).
+# E2E_API_USERNAME mirrors e2e@levkine.ca (admin role) in the FastAPI main DB.
+# E2E_API_VIEWER_USERNAME is a viewer-role account used only for role-permission
+# (write-gate) checks — see api.role-permissions.spec.ts.
 # E2E_API_USERNAME=
 # E2E_API_PASSWORD=
+# E2E_API_VIEWER_USERNAME=
+# E2E_API_VIEWER_PASSWORD=
 
 # Homelab Mailpit (preferred for DEV e2e)
 PLAYKIT_MAIL_PROVIDER=mailpit