test: testing overhaul -- CI e2e gates, parallel suites, generated matrices, mutation testing (#215)

Closes the "e2e never runs in CI" hole. Adds per-PR e2e smoke gate,
nightly full-suite workflows, parallel vitest forks (per-fork DBs),
Playwright parallel/serial/visual projects against production builds,
metadata-generated test suites (drift guards, hostile inputs, format
matrix, pairwise settings, property-based fuzz), Stryker mutation
testing, Schemathesis API fuzz, coverage ratchet, and fixes for three
session-poisoning bugs that caused 200+ serial-bucket failures.

Bug fix included: favicon/split/bulk-rename could hang clients forever
when ZIP streaming failed after reply.hijack().

package.json

@@ -36,7 +36,7 @@
     "test:coverage": "vitest run --coverage",
     "test:ci": "vitest run --coverage --reporter=verbose",
     "test:all": "vitest run --coverage && playwright test",
-    "test:e2e": "playwright test",
+    "test:e2e": "playwright test --project=chromium && playwright test --project=chromium-serial --workers=1 && playwright test --project=chromium-visual",
     "test:e2e:ui": "playwright test --ui",
     "test:e2e:landing": "playwright test --config playwright.landing.config.ts",
     "test:e2e:docs": "playwright test --config playwright.docs.config.ts",
@@ -54,6 +54,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.16",
+    "@fast-check/vitest": "^0.4.1",
     "@playwright/test": "^1.60.0",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/commit-analyzer": "^13.0.1",
@@ -68,13 +69,15 @@
     "@types/adm-zip": "^0.5.8",
     "@vitest/coverage-v8": "^3.2.6",
     "adm-zip": "^0.5.17",
+    "fast-check": "^4.8.0",
     "husky": "^9.1.7",
     "jsdom": "^29.1.1",
     "lint-staged": "^16.4.0",
     "semantic-release": "^25.0.3",
     "turbo": "^2.9.16",
     "typescript": "^5.7.0",
-    "vitest": "^3.2.6"
+    "vitest": "^3.2.6",
+    "zod-fast-check": "^0.10.1"
   },
   "license": "AGPL-3.0",
   "pnpm": {