test(e2e): pin unauthenticated wget-style denial for copyparty and homepage

Wget-style (no-JS) clients must never receive application bytes from guarded
services: copyparty serves authenticated traffic with anonymous read perms, so
the guard chain is the only boundary between an unauthenticated client and the
file bytes. Assertions target leakage markers in app code (Copyparty UI title,
homepage panel grid, services.json JSON shape), not gate internals, so any
guard-route regression fails the suite while any gate implementation passes.

Also route 15-*.spec.ts into the guest project (empty storage state).

tests/e2e/playwright.config.ts

@@ -36,7 +36,7 @@ export default defineConfig({
     },
     {
       name: "guest",
-      testMatch: /14-.*\.spec\.ts/,
+      testMatch: /(14|15)-.*\.spec\.ts/,
       use: { storageState: { cookies: [], origins: [] } },
     },
   ],