ci: richer step reports via Gitea 1.27 job summaries (closes #136) (#137)

## What & why

Use the standard `$GITHUB_STEP_SUMMARY` (Gitea 1.27 + act_runner 2.0.0) to surface on the run page what was previously buried in logs or download-only artifacts. All five quick wins from #136, **reporting-only** — no job's pass/fail gating changes.

Closes #136

### Items

1. **Mutation scores** — added the `markdown` reporter to each `stryker-config.json`; the `mutation` job concatenates each service's `mutation-report.md` into the summary (`if: always()`). Also reveals where `make mutation` stopped on a ratchet break.
2. **Per-frontend tests** — the 4 apps' `test` targets emit vitest JSON to `test-output/{projectName}.json` (Nx token interpolation); `infra/vitest-summary.py` renders a per-frontend table.
3. **Per-service unit tests** — `make unit` now writes TRX; `infra/trx-summary.py` renders a per-service table (service name derived from the `services/<name>/` path, so `domain` shows, not `big.tests`).
4. **e2e per-spec results** — Playwright writes `playwright-report.json`; `run-e2e-check.sh` copies it out of the container (capturing the exit code first); `infra/playwright-summary.py` renders a per-spec table. Turns a red e2e into a one-glance "which spec".
5. **verify-stack check table** — each live-stack check has an `id`; a final `if: always()` step tabulates each check's ✅/❌/⏭️.

Docs: `gitea-actions-gotchas.md` §8 (version requirement + `$GITHUB_STEP_SUMMARY` guard + step-level `always()` note).

### Notes

- Every summary write is guarded with `[ -n "${GITHUB_STEP_SUMMARY:-}" ]`, so it no-ops on an unsupported runner / locally.
- New helper scripts are stdlib-only Python, matching the existing `infra/*.py` check scripts (no new dependency — a few lines of parsing rather than a test-logger package).
- `TestResults/` and `test-output/` gitignored.
- This is also the first PR-run exercising the #135 verify-stack fix end to end.

## Verified locally

`make unit` (TRX) ✓ · 4 apps' vitest JSON ✓ · ACL Stryker markdown report ✓ · all four parsers + the two summary shell blocks ✓ · `ci.yaml` + `run-e2e-check.sh` syntax ✓. The rendered summaries themselves only appear on the run page — this PR's CI run is the end-to-end check.

## Definition of Done

- [x] Each item writes to `$GITHUB_STEP_SUMMARY` (guarded), renders on the run page.
- [x] No change to any job's pass/fail gating.
- [x] Conventional Commits referencing #136 (one per item + docs).
- [ ] CI green; summaries visible on the run.
- [x] Runbook note (gotchas §8).

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #137

infra/playwright-summary.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+"""Render a per-spec table from a Playwright JSON report for a Gitea job summary (#136).
+
+Reads the JSON report (default: tests/e2e/playwright-report.json) that run-e2e-check.sh copies out
+of the e2e container, and prints a markdown table (one row per spec) to stdout. The CI step
+redirects it into $GITHUB_STEP_SUMMARY. Stdlib only.
+"""
+import json
+import os
+import sys
+
+STATUS_ICON = {"expected": "✅", "unexpected": "❌", "skipped": "⏭️", "flaky": "⚠️"}
+
+
+def walk(suite, out):
+    for spec in suite.get("specs", []):
+        # A spec's status is carried on its test(s): expected/unexpected/skipped/flaky.
+        statuses = [t.get("status") for t in spec.get("tests", [])]
+        status = ("unexpected" if "unexpected" in statuses
+                  else "flaky" if "flaky" in statuses
+                  else "skipped" if statuses and all(s == "skipped" for s in statuses)
+                  else "expected" if spec.get("ok", False)
+                  else "unexpected")
+        out.append({"file": spec.get("file") or suite.get("file") or suite.get("title", ""),
+                    "title": spec.get("title", ""), "status": status})
+    for child in suite.get("suites", []):
+        walk(child, out)
+
+
+def main(path):
+    if not os.path.exists(path):
+        print("## 🎭 e2e (Playwright)\n\n_No e2e report — the run did not reach the e2e step._")
+        return 0
+    with open(path) as fh:
+        report = json.load(fh)
+    specs = []
+    for suite in report.get("suites", []):
+        walk(suite, specs)
+
+    print("## 🎭 e2e (Playwright)\n")
+    stats = report.get("stats", {})
+    if stats:
+        print(f"**{stats.get('expected', 0)} passed · {stats.get('unexpected', 0)} failed · "
+              f"{stats.get('flaky', 0)} flaky · {stats.get('skipped', 0)} skipped** "
+              f"({round(stats.get('duration', 0) / 1000)}s)\n")
+    if not specs:
+        print("_No specs ran._")
+        return 0
+    print("| Spec | Result |")
+    print("| ---- | :----: |")
+    for s in specs:
+        print(f"| {s['file']} › {s['title']} | {STATUS_ICON.get(s['status'], '❔')} |")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1] if len(sys.argv) > 1 else "tests/e2e/playwright-report.json"))