feat(infra): beheer portal in compose + e2e + ADR-0025 + demo note (refs #130)

tests/e2e/playwright.config.ts

@@ -6,6 +6,9 @@ const baseURL = process.env.SELF_SERVICE_URL ?? 'http://self-service';
 // The behandel portal is a second origin the happy path visits (staff approve from the werkbak);
 // it needs the same insecure-origin-as-secure treatment as self-service for the PKCE login (below).
 const behandelURL = process.env.BEHANDEL_URL ?? 'http://behandel';
+// The beheer portal is a third medewerker-realm origin (the read-only catalogus viewer, S-15a); it
+// needs the same insecure-origin-as-secure treatment as the others for the PKCE login (below).
+const beheerURL = process.env.BEHEER_URL ?? 'http://beheer';
 
 export default defineConfig({
   testDir: '.',
@@ -33,7 +36,7 @@ export default defineConfig({
     channel: 'chromium',
     launchOptions: {
       args: [
-        `--unsafely-treat-insecure-origin-as-secure=${baseURL},${behandelURL}`,
+        `--unsafely-treat-insecure-origin-as-secure=${baseURL},${behandelURL},${beheerURL}`,
         // Write Chromium's shared memory to /tmp instead of the container's small /dev/shm, so a
         // large DOM/heap can't crash the renderer on the memory-constrained runner (belt-and-braces
         // alongside the single worker above).