Bind the CI dev server to all interfaces and surface login errors

Playwright's request context resolves localhost to ::1 while Vite in
the CI container listened on IPv4 only — the fixture-login helper got
ECONNREFUSED. Vite now starts with --host in the auth-e2e job. The
redirect test also reports the server's error message instead of a
bare URL mismatch when a login fails.

Part of #20

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -104,7 +104,7 @@ jobs:
       - name: Start api and web dev server
         run: |
           (cd apps/api && PORT=3001 node dist/main.js &)
-          (pnpm --filter @dorfteich/web dev -- --port 5173 --strictPort &)
+          (pnpm --filter @dorfteich/web dev -- --host --port 5173 --strictPort &)
           for i in $(seq 1 30); do
             curl -sf http://localhost:3001/api/v1/readyz >/dev/null && break
             sleep 2

apps/web/e2e/auth.spec.ts

@@ -57,7 +57,14 @@ test('anonymous visitors are redirected to login and return after', async ({ pag
   await page.getByLabel(/username or e-mail|benutzername oder e-mail/i).fill('fixture-user');
   await page.getByLabel(/^password|^passwort/i).fill('fixture passwort 123');
   await page.getByRole('button', { name: /sign in|anmelden/i }).click();
-  await expect(page).toHaveURL(/\/settings/);
+  // Surface the server answer in CI logs instead of a bare URL mismatch.
+  const alert = page.getByRole('alert');
+  await Promise.race([
+    page.waitForURL(/\/settings/),
+    alert.waitFor().then(async () => {
+      throw new Error(`login failed with: ${await alert.textContent()}`);
+    }),
+  ]);
 });
 
 test('fixture user signs out via the menu', async ({ browser }) => {