Wire Playwright E2E tests into CI push workflow

## Goal
After every branch deployment, the CI workflow automatically runs the full Playwright E2E suite against the deployed CloudFront URL. A failed chat test blocks the branch.

## Acceptance criteria
- E2E tests run in `deploy.yml` immediately after the S3 sync + CloudFront invalidation step
- Playwright reads its config from SSM (via `pnpm fetch:e2e-config`, added in PR #27) — no local build required
- A failed chat test (including AG-UI stream verification) fails the workflow
- Playwright HTML report is uploaded as a GitHub Actions artifact on failure

## Required GitHub secrets
- `TEST_USER_EMAIL` and `TEST_USER_PASSWORD` — test Cognito credentials used by `web/e2e/auth.setup.ts`

## Dependencies
- Issue #145 (push-triggered deployment workflow)
- Issue #146 (strengthened AG-UI chat test)
- PR #27 (SSM-based e2e config) must be merged

## Notes
Install Playwright with `pnpm exec playwright install --with-deps chromium` before running. The `--project=chromium` flag keeps CI time reasonable.

---
*Imported from `waltmayf/agentcore-amplify-fullstack`#33 — originally filed by @waltmayf on 2026-07-02. Migrated to open-source repo; cross-references updated post-import.*

Read the push deployment workflow in deploy.yml and the Playwright setup in web/e2e/auth.setup.ts; first verify that PR #27's pnpm fetch:e2e-config command is available. Run Playwright with --project=chromium after deployment, using the required Cognito secrets. Done means the suite runs after S3 sync and CloudFront invalidation, chat failures fail CI, and the HTML report is uploaded on failure.

Written by the indexing model from the issue text.