test(frontend): Playwright e2e F1 vs backend+fake-pi (hermetic)

Adds a real-browser Playwright e2e of the full F1 disambiguation loop,
driven against the real backend + fake binaries (no VPN, no real Pi, no Python).

- frontend/e2e/fixtures/fake-tht.mjs: stubs tht CLI (session new/list/show)
- frontend/e2e/fixtures/fake-pi.mjs: wraps harness fake-pi-rpc with f1_disambiguation.json
- frontend/playwright.config.ts: two webServer entries (backend:8799, frontend:5199)
- frontend/e2e/f1.spec.ts: open app → create session → wait for SelectWidget → respond

Bug fixes discovered during e2e:
- useSessionStream: add addEventListener for named SSE events (backend sends
  'event: ui_request' etc.; onmessage only fires for unnamed 'event: message')
- FakeEventSource: add no-op addEventListener/removeEventListener stubs
- backend SSE route: add CORS headers manually in writeHead() since
  reply.raw bypasses the @fastify/cors onSend hook
- backend: install and register @fastify/cors for all non-SSE routes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/e2e/fixtures/fake-pi.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+// fake-pi.mjs — hermetic PI_BIN stub for e2e tests.
+// Ignores all argv (the backend passes --mode rpc --approve) and
+// exec()s the scripted fake-pi-rpc.mjs with the F1 disambiguation scenario.
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+import { execFileSync } from "node:child_process";
+
+const __dir = dirname(fileURLToPath(import.meta.url));
+const fakePiRpc = resolve(__dir, "../../..", "harness/tests/fake_pi/fake_pi_rpc.mjs");
+const scenario = resolve(__dir, "../../..", "harness/tests/fake_pi/scripts/f1_disambiguation.json");
+
+// exec replaces the current process so the backend's child handle stays valid.
+// On Node.js we use spawnSync with stdio inherit to approximate exec().
+const { spawnSync } = await import("node:child_process");
+const result = spawnSync(process.execPath, [fakePiRpc, scenario], {
+  stdio: "inherit",
+  env: { ...process.env },
+});
+process.exit(result.status ?? 0);

frontend/e2e/fixtures/fake-tht.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// fake-tht.mjs — hermetic THT_BIN stub for e2e tests.
+// Parses argv and emits the minimal JSON the backend expects.
+// The backend's ThtRunner prepends: thtBin -c <config> <subcommand> [args...]
+// So we skip the first two args after node (-c <configPath>).
+
+const argv = process.argv.slice(2); // drop "node" + script path
+
+// Strip leading "-c <value>" pair (ThtRunner always prepends this).
+let args = argv;
+if (args[0] === "-c") {
+  args = args.slice(2);
+}
+
+// args now starts with the subcommand group, e.g. ["session","new","...","--json"]
+const sub = args.slice(0, 2).join(" ");
+
+if (sub === "session new") {
+  // session new <question> [--provider p] [--model m] [--thinking t] [--name n] --json
+  process.stdout.write(JSON.stringify({ id: "e2e-1" }) + "\n");
+} else if (sub === "session list") {
+  process.stdout.write(JSON.stringify([]) + "\n");
+} else if (sub === "session show") {
+  const id = args[2] ?? "e2e-1";
+  process.stdout.write(
+    JSON.stringify({ id, status: "open", provider: null, model: null, thinking: null }) + "\n",
+  );
+} else if (sub === "sql preview") {
+  process.stdout.write(
+    JSON.stringify({ columns: [], rows: [], execution_ms: 0, truncated: false }) + "\n",
+  );
+} else {
+  // Unknown subcommand — exit 0 with empty JSON so the backend doesn't crash.
+  process.stdout.write("{}\n");
+}
+process.exit(0);