fix(e2e): unblock E2E test environment — CSP, CORS, and env var fixes

Root causes of web E2E failures:
1. CSP connect-src only included API origin for NODE_ENV=development,
   blocking test mode (NODE_ENV=test) from fetching API data
2. CORS_ORIGINS missing the test web port (3010), so API rejected
   cross-origin requests from the web app
3. NEXT_PUBLIC_API_URL not set in .env.test or playwright config,
   causing web app to default to port 3001 instead of test port 3011
4. Playwright webServer config didn't inherit parent env vars,
   so API server lacked Redis/Typesense/MinIO connection info

Fixes:
- next.config.js: CSP connect-src allows API origins for all non-prod envs
- next.config.js: image remotePatterns allow localhost in test mode
- .env.test: add NEXT_PUBLIC_API_URL and CORS_ORIGINS
- playwright.config.ts: spread process.env into webServer env configs
- e2e.yml: add NEXT_PUBLIC_API_URL, API_PORT, WEB_PORT to GH Actions env
- homepage.spec.ts: update stale assertions to match current UI

Result: 147/202 tests passing (111 API + 36 web), up from 37/91.
Remaining 55 web failures are stale UI assertions needing frontend update.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/next.config.js

@@ -13,8 +13,8 @@ const nextConfig = {
         protocol: 'https',
         hostname: '**',
       },
-      // MinIO / local object storage in development
-      ...(process.env.NODE_ENV === 'development'
+      // MinIO / local object storage in development and test
+      ...(process.env.NODE_ENV !== 'production'
         ? [{ protocol: 'http', hostname: 'localhost' }, { protocol: 'http', hostname: '127.0.0.1' }]
         : []),
     ],
@@ -41,7 +41,7 @@ const nextConfig = {
               "style-src 'self' 'unsafe-inline' https://api.mapbox.com",
               "img-src 'self' data: blob: https://*.mapbox.com https://*.tiles.mapbox.com https:",
               "font-src 'self' data:",
-              `connect-src 'self' https://*.mapbox.com https://api.mapbox.com https://events.mapbox.com${process.env.NODE_ENV === 'development' ? ' http://localhost:3001' : ''}`,
+              `connect-src 'self' https://*.mapbox.com https://api.mapbox.com https://events.mapbox.com${process.env.NODE_ENV !== 'production' ? ' http://localhost:3001 http://localhost:3011' : ''}`,
               "worker-src 'self' blob:",
               "child-src 'self' blob:",
               "frame-ancestors 'none'",