e2e test suite + bunch of bugfixes

[visortelle]

Implemented Playwright e2e test suite.
They're mostly agentic-coded with a few review rounds, but it allows us to introduce new changes more frequently.

Bugs fixed

All fixes ship with regression coverage — e2e knownbugs/*Spec, jest component tests, or server unit tests — each proven red against the pre-fix code.

Consumer session

• Session-level filter halted the stream — with a session-level (merged-stream) filter, loading stopped at the first non-matching message: the server sent a zero-message response that made the client throw while reading the trailing counters, killing the stream handler. Now emits a count-only placeholder, matching the per-target path. — server/.../ConsumerSessionRunner.scala · regression CS-10s
• BUG-4 — play/pause tooltip was always "Start or Resume" regardless of state (the "Pause" branch was dead code). — ConsumerSession/Toolbar/Toolbar.tsx
• BUG-5 — "Message Id" and "Ordering key" columns weren't sortable (the only two headers missing a sortKey). — ConsumerSession.tsx, sort.ts
• BUG-6 — Start-From label typo ("Skip fist n messages"). — StartFromInput.tsx
• BUG-15 — Export was enabled while paused with 0 messages (inconsistent paused-only carve-out). — ExportMessagesButton.tsx

Forms & validation

• BUG-1 — create/delete forms silently reported success on a transport failure instead of showing an error and staying on the form; Delete even showed a green "deleted" toast on a failed delete. Fixed across 5 sites. — CreateTenantPage, ResourceGroupForm (+DeleteDialog), CreateNamespace, CreateSubscription
• BUG-3 — Create Subscription accepted an empty/invalid "Message with specific ID" (the guard compared the field value to the literal string "messageId"), silently creating the subscription at earliest. — CreateSubscription.tsx

Library

• BUG-2 — KeyValueEditor "As JSON" discarded edits (the onChange returned a function instead of calling it) and ignored read-only. — KeyValueEditor.tsx
• BUG-7 — "Available in Contexts" Confirm applied the change but left the modal open (only Cancel closed it). — AvailableInContextsButton.tsx
• BUG-8 — a library item saved with zero contexts was invisible to every search; now rejected on write. — server/.../Library.scala
• BUG-9 — an empty "Search in Contexts" filter is now a distinguishable INVALID_ARGUMENT instead of a silent empty result; client call sites guard the empty case (no request, empty results, no error toast). — Library.scala, SearchResults.tsx, PickLibraryItemButton.tsx
• BUG-17 (security) — an unsanitized library item id allowed path traversal (../../x escaped the library root, enabling arbitrary .binpb write/delete). Now charset-allowlisted on write/delete; reads unaffected so existing items still load. — Library.scala

Navigation, tables & misc UI

• BUG-12 — NavigationTree label typo ("Navigating o the selected resource"). — NavigationTree.tsx
• BUG-13 — SubscriptionPage toolbar didn't highlight the active tab (TopicPage did). — SubscriptionPage.tsx
• BUG-14 — removed a stray console.log('overlay', …). — HealthCheckContext.tsx
• BUG-18 — pasting a topic FQN into the tree filter duplicated the topic segment (t/ns/topic/topic), caused by a dead === undefined branch and a stateful /g regex reused with .test(). — NavigationTree.tsx
• BUG-19 — adding an "AuthParamsString" credential threw Unknown credentials type: 4 in the list conversion, which broke the entire credentials list from rendering; added the missing conversion case + label. — pulsar-auth/conversions.ts, Editor.tsx
• "⭐️ Updates" panel — the instance-overview Updates note embedded github.com in an iframe, which GitHub blocks (X-Frame-Options), so it was permanently blank; replaced with a Markdown note linking to the GitHub releases page (opens in a new tab). — Notes/blog-note.tsx, Notes.tsx

Reclassified (not bugs — intended design, pinned by tests)

• BUG-11 — the app-global auto-refresh toggle was initially catalogued as a bug ("should be per-table") and briefly fixed that way, then reclassified: auto-refresh is deliberately one global preference. A regression test now pins the global-shared semantics (flip one table's toggle → every table follows).
• BUG-16 — "LibraryService unscoped by cluster" was initially fixed with per-connection storage subdirs, then reclassified and reverted: a Dekaf instance always serves exactly one Pulsar, so isolation lives at the deployment layer (the desktop app gives each saved connection its own DEKAF_DATA_DIR; docker runs one Dekaf per Pulsar). The library dir stays flat; BUG-17's traversal guard is unaffected.

Instrumentation (not a user-facing defect)

• BUG-10 — the permission "revoke" button used a non-row-unique data-testid (the click handler was already row-correct); suffixed with the role for test addressability. — Permissions.tsx