ci(e2e): tier-3 regression suite against a Synapse the job starts itself (#220)

The e2e job now runs scripts/dev-homeserver.sh start + dev-seed.py before
Playwright (installing python3-venv if the runner lacks it) and stops it
afterwards. e2e/local-homeserver.spec.ts registers its own users and rooms
over the CS API and drives the built client — no prod secrets — covering the
fixes that were reproduced with scratch scripts this week: login/send/receive,
own-message scroll (#212), /kick toast (#216), upload 413 wording (#213),
forward provenance, thread panel at 1400px (#218), timeline lightbox (#219),
clock-skew banner via page.clock (#158), status save under the presence limit
(#226), long-press action sheet on a Pixel 7 emulation (#166). Skips itself
when no homeserver answers, so
> lotus-chat@4.12.7-lotus test:e2e
> playwright test

Running 16 tests using 1 worker

  ✓   1 [chromium] › e2e/boot.spec.ts:8:3 › boot › client boots to the login screen without errors (1.5s)
  ✓   2 [chromium] › e2e/boot.spec.ts:27:3 › boot › service worker script is served and registers (1.4s)
  ✓   3 [chromium] › e2e/boot.spec.ts:54:3 › boot › bundled Element Call loads in a frame (3.8s)
  -   4 [chromium] › e2e/e2ee-composer.spec.ts:67:3 › E2EE composer › logs in with a password and reaches the client
  -   5 [chromium] › e2e/e2ee-composer.spec.ts:84:3 › E2EE composer › creates a private encrypted room and sends a text message
  -   6 [chromium] › e2e/e2ee-composer.spec.ts:146:3 › E2EE composer › attaches a compressed image and it is sent encrypted
  ✓   7 [chromium] › e2e/local-homeserver.spec.ts:31:3 › local homeserver regression › logs in, opens a room, sends and receives (4.5s)
  ✓   8 [chromium] › e2e/local-homeserver.spec.ts:58:3 › local homeserver regression › your own message scrolls into view even after scrolling up (#212) (11.4s)
  ✓   9 [chromium] › e2e/local-homeserver.spec.ts:76:3 › local homeserver regression › /kick failure is reported, not swallowed (#216) (5.4s)
  ✓  10 [chromium] › e2e/local-homeserver.spec.ts:90:3 › local homeserver regression › upload failure shows a plain sentence, never the raw MatrixError (#213) (3.7s)
  ✓  11 [chromium] › e2e/local-homeserver.spec.ts:122:3 › local homeserver regression › forwarded message carries its provenance header (6.7s)
  ✓  12 [chromium] › e2e/local-homeserver.spec.ts:143:3 › local homeserver regression › thread panel: opens from the chip and yields the member drawer at 1400px (#218) (4.7s)
  ✓  13 [chromium] › e2e/local-homeserver.spec.ts:172:3 › local homeserver regression › timeline image opens the gallery lightbox (#219) (3.9s)
  ✓  14 [chromium] › e2e/local-homeserver.spec.ts:204:3 › local homeserver regression › warns when the local clock is far off the server (#158) (6.5s)
  ✓  15 [chromium] › e2e/local-homeserver.spec.ts:221:3 › local homeserver regression › status save survives the presence rate limit (#226) (12.6s)
  ✓  16 [chromium] › e2e/local-homeserver.spec.ts:265:3 › local homeserver regression › touch: long-press opens the message action sheet (#166) (5.0s)

  3 skipped
  13 passed (1.2m) still works cold. 13 pass
locally against dist + the dev homeserver in 1.8 min.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

.gitea/workflows/ci.yml

@@ -238,6 +238,8 @@ jobs:
   #                 as m.room.encrypted. Skips itself unless the E2E_* secrets
   #                 below are set (create them under repo → Settings → Actions
   #                 → Secrets; they are empty until then).
+  #   local tier  — (#220) regression suite against a Synapse this job starts
+  #                 itself; skips itself if that homeserver isn't reachable.
   # dist/ is rebuilt in-job because actions/upload-artifact@v4 does not work
   # on this Gitea runner (see LOTUS_REFERENCE.md → CI/CD), so `needs: build` only gates on the
   # main job having passed, not on its artifact.
@@ -282,6 +284,21 @@ jobs:
           NODE_OPTIONS: '--max_old_space_size=6144'
           VITE_APP_VERSION: ${{ github.sha }}
 
+      # ── #220 — tier 3: a throwaway Synapse the job starts itself (SQLite,
+      # open registration, no rate limits; scripts/dev-homeserver.sh). The
+      # regression spec (e2e/local-homeserver.spec.ts) registers its own users
+      # and rooms through the CS API and drives the built client against it —
+      # no prod secrets involved. If the homeserver fails to come up the spec
+      # skips itself and the step below still reports why.
+      - name: Start local homeserver
+        id: local_hs
+        continue-on-error: true
+        run: |
+          python3 -m venv --help >/dev/null 2>&1 || { (command -v sudo >/dev/null && sudo -n true 2>/dev/null && sudo apt-get update -qq && sudo apt-get install -y -qq python3-venv) || (apt-get update -qq && apt-get install -y -qq python3-venv); }
+          scripts/dev-homeserver.sh start
+          python3 scripts/dev-seed.py 20 > .dev-homeserver/seed.json
+          echo "E2E_LOCAL_HS=http://localhost:8008" >> "$GITHUB_ENV"
+
       - name: Playwright smoke test
         run: npm run test:e2e
         env:
@@ -289,3 +306,7 @@ jobs:
           E2E_HOMESERVER: ${{ secrets.E2E_HOMESERVER }}
           E2E_USER: ${{ secrets.E2E_USER }}
           E2E_PASSWORD: ${{ secrets.E2E_PASSWORD }}
+
+      - name: Stop local homeserver
+        if: always()
+        run: scripts/dev-homeserver.sh stop || true