e2e: run health probe + Playwright on the compose network

Gitea's act-style runners execute workflow steps inside a runner
container, so compose's host port-publish (127.0.0.1:8080:8080) is
not reachable from the steps. PR #23's e2e job timed out waiting
for the server even though the container was up and listening.

Move both the health probe and the Playwright run onto rmnet so
they address the server as http://server:8080:

* health probe: docker run --rm --network e2e_rmnet curlimages/curl
* Playwright: new mcr.microsoft.com/playwright-based image, added
  as a profile-gated `playwright` service in compose.e2e.yml,
  invoked via `docker compose run --rm playwright`. Drops the
  setup-node + npm install runner steps.

e2e/compose.e2e.yml

@@ -63,6 +63,27 @@ services:
       - agent-state:/var/lib/restic-manager-agent
     networks: [rmnet]
 
+  # Playwright test runner. Profile-gated so `compose up` doesn't
+  # start it; CI runs it via `compose run --rm playwright`. Lives on
+  # rmnet so it can reach the server via its compose-network DNS
+  # name rather than depending on host port-publish (which doesn't
+  # work on Gitea's container-based runners).
+  playwright:
+    profiles: [test]
+    build:
+      context: ..
+      dockerfile: e2e/Dockerfile.playwright
+    environment:
+      RM_BASE_URL: "http://server:8080"
+      RM_BOOTSTRAP_TOKEN: "${RM_BOOTSTRAP_TOKEN:-}"
+    volumes:
+      - ./playwright/playwright-report:/work/playwright-report
+      - ./playwright/test-results:/work/test-results
+    depends_on:
+      - server
+      - agent
+    networks: [rmnet]
+
   # One-shot init container that drops a couple of files into the
   # source volume so backups have something to snapshot.
   source-fixture: