e2e: extract Playwright report via docker cp instead of bind mount

When the runner job runs inside a container, compose's relative
`./playwright/playwright-report` resolves to a path that exists
only inside the runner container, so the host's docker daemon
silently bind-mounts an empty dir and the report never lands
anywhere we can read.

Drop the bind mounts; keep the playwright container around
(--name e2e-pw, no --rm); after the test, `docker cp` the
report and traces out into the runner's workspace volume so
upload-artifact has something real to upload. The new test-results
directory (Playwright traces, screenshots, videos) is also
included so failure post-mortem doesn't need a re-run.

e2e/compose.e2e.yml

@@ -64,10 +64,18 @@ services:
     networks: [rmnet]
 
   # Playwright test runner. Profile-gated so `compose up` doesn't
-  # start it; CI runs it via `compose run --rm playwright`. Lives on
+  # start it; CI invokes it via `compose run` and `docker cp`s the
+  # report+traces out (see .gitea/workflows/e2e.yml). Lives on
   # rmnet so it can reach the server via its compose-network DNS
   # name rather than depending on host port-publish (which doesn't
   # work on Gitea's container-based runners).
+  #
+  # Reports are NOT bind-mounted: when the runner job itself runs
+  # inside a container, `./playwright/...` resolves to a path that
+  # only exists inside the runner container, so the host docker
+  # daemon would silently mount an empty dir. Instead the report
+  # stays inside the playwright container and the workflow extracts
+  # it via `docker cp` before tearing down.
   playwright:
     profiles: [test]
     build:
@@ -76,9 +84,6 @@ services:
     environment:
       RM_BASE_URL: "http://server:8080"
       RM_BOOTSTRAP_TOKEN: "${RM_BOOTSTRAP_TOKEN:-}"
-    volumes:
-      - ./playwright/playwright-report:/work/playwright-report
-      - ./playwright/test-results:/work/test-results
     depends_on:
       - server
       - agent