test: add automated tests for newsletter logic

[wpf500]

Adds automated coverage for the newsletter group subscribe/unsubscribe paths introduced in #679, and fixes the test newsletter provider so those paths can be tested against it.

Why

#679 changes how newsletter groups are synced: groups are only sent to the provider when an update explicitly includes them, and a new add/remove mode sends partial group updates so the provider's state isn't overwritten. Only the Mailchimp payload builder had unit tests; none of the service-level paths (self-service unsubscribe, callout opt-in, admin replace, retry limits, authorization) were covered end to end.

Changes

fix(core): stateful TestProvider
The provider returned contact.groups ?? [] as the contact's new group state, so with the test provider a remove of group X set the contact's groups to exactly [X], and a name change wiped all groups. It now keeps contacts in memory and applies add/remove/replace the way Mailchimp does, including rejecting unknown group IDs with CantUpdateNewsletterGroupsError. NoneProvider is untouched since it has no groups.

test: API tests (apps/e2e-api-tests, 13 tests)

• list groups as member (me) and as admin, empty list for a contact without groups
• authorization: member can't read or change another contact's groups
• unsubscribe removes only the given group, last group leaves the contact subscribed with no groups
• unknown group ID → 400 without retry; contact with status None → 500 instead of silent success
• contact update without group changes keeps groups; admin update replaces them
• callout opt-in adds groups without removing existing ones and doesn't send a subscribed contact back to pending; sets pending for a contact without status

Contacts are created per test file and act via the admin API key plus x-contact-id header rather than cookie login: the client's cookie store is a static shared between all instances in a process, so multiple logins invalidate each other's sessions.

test: browser test (apps/browser-tests)
Member opens Account → Subscriptions, unsubscribes from one group, sees the notification, the list shrinks and stays shrunk after reload; an aborted DELETE shows the error notification and keeps the group.

ci: frontend-new in docker-compose.test.yml
The test stack only built apps/frontend-old. The subscriptions tab lives in the new frontend, which the router serves behind the beabee_frontend=new cookie. The service is added to the test compose file and the new test sets the cookie; existing browser tests keep running against the old frontend. This adds one image build to the browser test job. Can be split out if you'd rather merge the infrastructure change separately.

Not covered

Paths that depend on real Mailchimp behaviour still need a manual check against a test audience: the profile update webhook round trip, email change keeping interests, and the compliance-state retry. Two provider-level edge cases (a group unknown locally surviving an update; a stale cached ID being healed by the refresh-and-retry on replace) need the /dev/newsletter-groups endpoint, which the existing integrations test already mutates globally, so they're left out to avoid cross-file races.

Test runs

• API tests: https://github.com/beabee-communityrm/monorepo/actions/runs/33763258940 (19 files, 102 passed)
• Browser tests: https://github.com/beabee-communityrm/monorepo/actions/runs/33763261786 (7 passed)

🤖 Generated with Claude Code