build(frontend-builder): bake Playwright + chromium browser binary

CI's frontend test-e2e job was running `pnpm exec playwright install
chromium` every time — ~170MB chromium download per run, plus the
fall-through to `actions/cache` for the browser binary which only
hides the cost when the cache backend is healthy.

Bake it into the image instead:
- New ARG PLAYWRIGHT_VERSION=1.59.1 (must match KollectAI-ETL's
  frontend/svelte/package.json @playwright/test pin)
- New ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright (constant location
  Playwright respects across pnpm/npm invocations)
- New RUN: `npx --yes "playwright@${PLAYWRIGHT_VERSION}" install chromium`

System libs (libnss3, libgbm1, libasound2, etc.) were already
pre-installed at the top of the file, so we skip --with-deps. Verify
step now also lists $PLAYWRIGHT_BROWSERS_PATH contents to fail-fast
if a future bump leaves the dir empty.

KollectAI-ETL's frontend.yml drops both `Cache Playwright browsers`
and `Install Playwright browsers` steps in the matching commit on
that side. Net: image build adds ~170MB but every CI test-e2e run
saves ~30-60s (download time + cache I/O).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ci/frontend-builder/Dockerfile

@@ -4,7 +4,7 @@
 # protobuf TypeScript code generation.
 # Contains: Node.js, pnpm, buf CLI, @bufbuild/protoc-gen-es plugin
 # (global so buf 'local: protoc-gen-es' resolves via PATH), Playwright
-# system deps, ORAS CLI, common build tools.
+# (chromium browser binary + system deps), ORAS CLI, common build tools.
 #
 # Build:
 #   docker build -t 192.168.1.72/kollect-tools/ci/frontend-builder:latest ci/frontend-builder/
@@ -24,14 +24,19 @@ ARG BUF_VERSION=1.55.0
 # but we still bake it for ad-hoc use inside the container.
 ARG PROTOC_GEN_ES_VERSION=2.12.0
 ARG ORAS_VERSION=1.2.2
+# Pin Playwright in lockstep with frontend/svelte/package.json's
+# @playwright/test version. If the project uses a different patch level,
+# Playwright re-downloads the right browser at runtime; matching here
+# means CI hits the prebaked browser cache and skips the download.
+ARG PLAYWRIGHT_VERSION=1.59.1
+
+# Install Playwright browsers under a known global path so they survive
+# across containers and so `pnpm exec playwright install` reuses them.
+ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
 
 # ─────────────────────────────────────────────────────────────────────
-# System dependencies
-#
-# The Playwright system libs (libnss3 ... libasound2) are pre-installed
-# so test-e2e jobs can skip `playwright install --with-deps` and just
-# run `playwright install chromium` (browser binary still cached at
-# ~/.cache/ms-playwright in CI). Saves ~30s per E2E run.
+# System dependencies (Playwright chromium runtime libs included so the
+# browser launches without `playwright install --with-deps`)
 # ─────────────────────────────────────────────────────────────────────
 RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates \
@@ -82,6 +87,17 @@ RUN npm install -g "@bufbuild/protoc-gen-es@${PROTOC_GEN_ES_VERSION}"
 RUN curl -fsSL "https://github.com/oras-project/oras/releases/download/v${ORAS_VERSION}/oras_${ORAS_VERSION}_linux_amd64.tar.gz" \
     | tar -xz -C /usr/local/bin oras
 
+# ─────────────────────────────────────────────────────────────────────
+# Playwright + chromium browser binary
+#
+# Browsers go to /ms-playwright (PLAYWRIGHT_BROWSERS_PATH set above) so
+# CI's `pnpm exec playwright install chromium` finds the prebaked binary
+# and skips the ~170MB download. System libs are already installed at
+# the top of the file, so we use bare `playwright install chromium`
+# (no --with-deps).
+# ─────────────────────────────────────────────────────────────────────
+RUN npx --yes "playwright@${PLAYWRIGHT_VERSION}" install chromium
+
 WORKDIR /workspace
 
 # Verify installation
@@ -90,4 +106,5 @@ RUN node --version \
     && buf --version \
     && protoc-gen-es --version \
     && oras version \
-    && jq --version
+    && jq --version \
+    && ls "${PLAYWRIGHT_BROWSERS_PATH}"