test(e2e): approve via the behandel-portal werkbak instead of the admin endpoint (refs #13)

The walking-skeleton happy path now drives the real S-12 flow: after submit, a behandelaar logs

in to the behandel portal (medewerker realm), finds the registration in the werkbak by its

reference, and clicks Goedkeuren — replacing the temporary domain admin endpoint. Treat the

behandel origin as secure too, for its PKCE login.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/e2e/playwright.config.ts

@@ -3,6 +3,9 @@ import { defineConfig, devices } from '@playwright/test';
 // The e2e runs inside the compose network (infra/run-e2e-check.sh); baseURL defaults to the
 // self-service service. Keep timeouts generous — the first navigation triggers the DigiD flow.
 const baseURL = process.env.SELF_SERVICE_URL ?? 'http://self-service';
+// The behandel portal is a second origin the happy path visits (staff approve from the werkbak);
+// it needs the same insecure-origin-as-secure treatment as self-service for the PKCE login (below).
+const behandelURL = process.env.BEHANDEL_URL ?? 'http://behandel';
 
 export default defineConfig({
   testDir: '.',
@@ -22,7 +25,9 @@ export default defineConfig({
     // the production HTTPS context. This flag is only honoured by the full Chromium build (new
     // headless), not Playwright's default headless-shell, so pin `channel: 'chromium'`.
     channel: 'chromium',
-    launchOptions: { args: [`--unsafely-treat-insecure-origin-as-secure=${baseURL}`] },
+    launchOptions: {
+      args: [`--unsafely-treat-insecure-origin-as-secure=${baseURL},${behandelURL}`],
+    },
   },
   projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],
 });