tests: gate the hermes vhost, and stop specs from silently not running

Two gaps behind the same near-miss.

1. **No spec covered hermes.franksdank.cloud** — the one guarded vhost whose
   upstream is a host address (`reverse_proxy 192.168.0.143:8787`) rather than a
   container name, because its service is host-networked. That is how a
   loopback-only bind could take the vhost down with a 502 and leave every gate
   green. tests/e2e/specs/17-hermes-vhost.spec.ts asserts what a dead upstream
   violates: no 5xx through the guard chain, no Caddy error page, and no app
   bytes to an unauthenticated raw client. It does not assert SSO-silence, since
   this app has its own password login.

2. **Specs are matched by number prefix, not globbed.** A spec file whose prefix
   is in no project silently never runs — which is exactly what happened to the
   new one until it was registered. The prefix is registered now, the comment in
   playwright.config.ts says why, and tests/e2e_scaffold.bats fails if any
   spec file matches no project.

The hermes-webui seam assertion is corrected too: it asserted the loopback bind
I wrongly imposed, and now asserts the real contract — the unit's bind must serve
the address the Caddyfile fronts it on.

tests/e2e/playwright.config.ts

@@ -24,7 +24,12 @@ export default defineConfig({
     },
     {
       name: "standard",
-      testMatch: /(10|12|13|16)-.*\.spec\.ts/,
+      // NOTE: specs are matched by NUMBER PREFIX, not globbed. A spec file
+      // whose prefix is not listed in any project silently never runs — a
+      // green suite with a test that does not exist. 17- joined on 2026-09-16
+      // (the hermes vhost, whose upstream is a host address rather than a
+      // container name, so it needs its own pass condition).
+      testMatch: /(10|12|13|16|17)-.*\.spec\.ts/,
       use: { storageState: ".auth/qa-e2e.json" },
       dependencies: ["setup"],
     },