Add Playwright E2E suite; fix work-entry date persistence and cascade delete

[devin-ai-integration]

Summary

New e2e/ Playwright project (20 tests, all passing) covering login, client CRUD, the work-entry lifecycle, report totals + CSV export, and input edge cases. Tests run against the real backend/frontend — playwright.config.ts boots backend (3001) and frontend (5173) via webServer and reuses already-running servers.

Two application bugs the suite surfaced, plus one testability change:

Work-entry dates were persisted as epoch millis. Joi.date().iso() coerces date to a Date, which sqlite3 binds as a number, so the API and the CSV/PDF exports returned 1786320000000 instead of 2026-08-10:

Date,Hours,Description,Created At
1786320000000,2.5,,...      # before
2026-08-10,2.5,,...         # after

workEntries.js now normalizes to a calendar day (toDateOnly) on insert and update. Covered by the CSV export assertion in reports.spec.ts.

ON DELETE CASCADE was never enforced — sqlite defaults foreign_keys off, so deleting a client left orphaned work_entries rows (invisible in listings only because the list query INNER JOINs clients). initializeDatabase now runs PRAGMA foreign_keys = ON.

Rate limit is configurable via RATE_LIMIT_MAX / RATE_LIMIT_WINDOW_MS (defaults unchanged at 100 / 15 min). The global 100-requests-per-IP limit throttles a full suite run, so the E2E webServer raises it.

Test isolation comes from the app's own model: each test logs in with a unique email, and all data is scoped by user_email, so no cleanup is needed against the in-memory DB.

Backend unit tests (161) and the frontend lint/build still pass.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/7790300b33bf44b7b56f9a98100e185c

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.6% Duplication on New Code

See analysis details on SonarQube Cloud

[devin-ai-integration]

E2E verification — Playwright suite + manual GUI run

Ran the new Playwright suite headlessly and manually drove the app in Chrome against a local backend (RATE_LIMIT_MAX=100000) + Vite frontend. All checks passed; no bugs found.

Playwright: 20 passed (1.1m) — 0 failures, 0 flakes.

CSV export date fix — Date column is now YYYY-MM-DD, not epoch millis

Date,Hours,Description,Created At
2026-08-11,4.5,Sprint planning,2026-08-11 13:32:32
2026-08-11,2,Bugfix session,2026-08-11 13:34:09

The Work Entries and Reports tables also render 8/11/2026 rather than a 1970 date.

Reports totals recompute correctly

One 4.5h entry → 4.50 / 1 / 4.50; after adding a 2h entry → 6.50 / 2 / 3.25.

Client delete cascades to work entries (PRAGMA foreign_keys = ON)

Deleting the client removed both of its work entries — no orphan rows, no errors.

Other flows verified

• Invalid email not-an-email → red "Validation error" alert, stays on /login; valid email logs in.
• Client create → edit → delete; blank name blocked by validation.
• Work entry create → list → edit hours 3.5→4.5 → delete.
• Edge case: client name Ünïcødé & <Ç0>* "Test" Ltd. + 400-char description stored and rendered intact.