Add e2e + D1 integration tests, CI, and fix two bugs they found

[devandrepascoa]

What

• E2E (Playwright) against the built Worker (wrangler dev, throwaway local D1), 4 parallel workers: sign-in redirect, signed-in session, group + expense + settle up, stranger blocked, recurring expense.
• Integration (Vitest + @cloudflare/vitest-plugin) on a real local D1 with the production migrations: authorization, balances/simplification, expense create/edit/delete atomicity, settlements, recurrence (incl. idempotent retries), D1 query regressions.
• CI (.github/workflows/ci.yml): typecheck, integration and e2e as three parallel jobs; pnpm store, Playwright browsers and the build are cached. Target: under 2 minutes.
• Jest replaced by Vitest. All unit tests removed. Scenarios adapted from upstream PR Add testing harness oss-apps/split-pro#738.

Bugs the tests found (fixed here, not deployed yet)

1. Authorization: any signed-in user could read, edit or delete any expense by id (validateEditExpensePermission was effectively a no-op, getExpenseDetails had no check) and write expenses or currency conversions into any group. Added canAccessExpense and assertCanWriteToGroup.
2. Recurring expenses never ran: runRecurringJob used drizzle db.run() inside a D1 batch, which throws. Rewritten with prepared D1 statements.

Local results

• e2e: 6 passed, about 11 s wall clock (including server start)
• integration: 26 passed, about 17 s
• tsc --noEmit: clean
• The GitHub Actions run itself has not been run yet, so the 2-minute target is unverified on a real runner.

Not covered

Bank sync, Splitwise import, web-push, UI flows beyond sign-in and page loads (setup goes through tRPC).

[krokosik]

Hi @devandrepascoa

I admit that I am not an expert in testing webapps beyond jest and just let my agent set up the harness. If there are some comments or suggestions you might have to my solution, I would be glad to hear them and bring upstream :)