test: add dependency compatibility smoke checks

[Pigbibi]

Summary

Adds focused, no-credential compatibility checks for the pending otpauth and playwright Dependabot updates.

• Runs npm ci in CI and installs the same pinned Chrome 147.0.7727.137-1 used by the refresh workflow.
• Checks RFC 6238 Base32 and Secret.fromHex vectors, including the production whitespace normalization boundary.
• Smoke-tests playwright-extra with stealth and launchPersistentContext({ channel: 'chrome' }) against a local static page.

Validation

• node --check main.js
• Existing auth, proxy, workflow-source checks
• New TOTP and Playwright smoke checks on the current workspace and both Dependabot PR snapshots
• Local smoke used Chrome 153; the CI workflow pins Chrome 147 for the production-compatible result.

This PR contains tests and CI validation only. It does not change authentication, token handling, auto-merge rules, or production refresh logic.