Add 4 files, update 14 files

e2e-tests/smoke.spec.ts

@@ -0,0 +1,20 @@
+import { expect, test } from '@playwright/test';
+
+test('loads the signed-out application shell', async ({ page }) => {
+  await page.goto('/');
+
+  await expect(page).toHaveTitle(/SchulOS/i);
+  await expect(page.getByText('SchulOS', { exact: true }).first()).toBeVisible();
+  await expect(page.getByLabel(/email/i).first()).toBeVisible();
+  await expect(page.getByLabel(/password/i).first()).toBeVisible();
+});
+
+test('rejects cross-origin API mutations', async ({ request }) => {
+  const response = await request.post('/api/auth', {
+    headers: { origin: 'https://attacker.example' },
+    data: { action: 'logout' },
+  });
+
+  expect(response.status()).toBe(403);
+  await expect(response.json()).resolves.toMatchObject({ error: 'Invalid request origin' });
+});