test(frontend): align contracts and cross-browser coverage

[khalyaro]

Summary

• centralize shared API constraints for backend and frontend consumers
• add end-to-end coverage for filing a dispute through the modal
• run Playwright projects in Chromium, Firefox, and WebKit
• include app-level code and colocated tests in Jest coverage

Issues

• Frontend schemas duplicate backend DTO validation logic #1325
• No e2e test covering the dispute filing flow #1326
• Playwright config only runs a single browser project #1327
• Jest config excludes the app directory from coverage #1328

Validation

• static diff, config, import/export, and secret review completed
• automated tests, lint/typecheck, builds, browser installation, dependency installation, and CI were not run per maintainer request

Closes #1325
Closes #1326
Closes #1327
Closes #1328

[vercel]

@khalyaro is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@khalyaro Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[mftee]

Reviewed. Centralizing shared API constraints (email format, password/fullName min-length, dispute description length, upload MIME/size limits) into a single contracts/api-contracts.json synced to both backend and frontend closes a real drift-prevention gap — this is exactly the kind of value that's easy to skip and expensive later. The new dispute-filing E2E coverage and running Playwright across Chromium/Firefox/WebKit widens real-browser coverage instead of just Chromium. Including app-level code and colocated tests in Jest coverage gives an honest coverage number instead of one inflated by only counting unit-testable modules.

This PR conflicted with #1415 in three places, all resolved:

• register-auth.dto.ts / lib/schemas/auth.ts: combined this PR's contract-driven minLength with #1415's password complexity rules (uppercase/lowercase/number/special) and its translated message keys — neither side alone was complete, and picking one would have either dropped complexity validation or left an unlocalized message key.
• Found the underlying contract JSON was stale (password minLength still 6, fullName still 1) relative to the password policy #1415 already shipped (8 chars + complexity, "at least 2 characters" for fullName) — bumped both in the canonical contracts/api-contracts.json and re-ran contracts/sync.mjs to propagate to the backend/frontend copies, so the "shared source of truth" this PR introduces actually reflects the real policy instead of undermining it.
• This PR deleted frontend/app/schemas/register.schema.ts and frontend/e2e/dialog.spec.ts for reasons predating #1415 (which added a RegisterForm.tsx that still imports the former) and with no replacement for the latter's coverage — kept both rather than let the merge silently break the build and drop test coverage.

Approving.