Add e2e tests for server push events (#36879)

Add e2e tests for the three server push features:
- **Notification count**: verifies badge appears when another user
creates an issue
- **Stopwatch**: verifies stopwatch element is rendered when a stopwatch
is active
- **Logout propagation**: verifies logout in one tab triggers redirect
in another

Tests are transport-agnostic in preparation for a future WebSocket
migration.

---------

Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

tests/e2e/utils.ts

@@ -1,13 +1,18 @@
+import {randomBytes} from 'node:crypto';
 import {env} from 'node:process';
 import {expect} from '@playwright/test';
 import type {APIRequestContext, Locator, Page} from '@playwright/test';
 
-export function apiBaseUrl() {
+export function baseUrl() {
   return env.GITEA_TEST_E2E_URL?.replace(/\/$/g, '');
 }
 
+function apiAuthHeader(username: string, password: string) {
+  return {Authorization: `Basic ${globalThis.btoa(`${username}:${password}`)}`};
+}
+
 export function apiHeaders() {
-  return {Authorization: `Basic ${globalThis.btoa(`${env.GITEA_TEST_E2E_USER}:${env.GITEA_TEST_E2E_PASSWORD}`)}`};
+  return apiAuthHeader(env.GITEA_TEST_E2E_USER, env.GITEA_TEST_E2E_PASSWORD);
 }
 
 async function apiRetry(fn: () => Promise<{ok: () => boolean; status: () => number; text: () => Promise<string>}>, label: string) {
@@ -24,30 +29,73 @@ async function apiRetry(fn: () => Promise<{ok: () => boolean; status: () => numb
   }
 }
 
-export async function apiCreateRepo(requestContext: APIRequestContext, {name, autoInit = true}: {name: string; autoInit?: boolean}) {
-  await apiRetry(() => requestContext.post(`${apiBaseUrl()}/api/v1/user/repos`, {
-    headers: apiHeaders(),
+export async function apiCreateRepo(requestContext: APIRequestContext, {name, autoInit = true, headers}: {name: string; autoInit?: boolean; headers?: Record<string, string>}) {
+  await apiRetry(() => requestContext.post(`${baseUrl()}/api/v1/user/repos`, {
+    headers: headers || apiHeaders(),
     data: {name, auto_init: autoInit},
   }), 'apiCreateRepo');
 }
 
+export async function apiCreateIssue(requestContext: APIRequestContext, owner: string, repo: string, {title, headers}: {title: string; headers?: Record<string, string>}) {
+  await apiRetry(() => requestContext.post(`${baseUrl()}/api/v1/repos/${owner}/${repo}/issues`, {
+    headers: headers || apiHeaders(),
+    data: {title},
+  }), 'apiCreateIssue');
+}
+
+export async function apiStartStopwatch(requestContext: APIRequestContext, owner: string, repo: string, issueIndex: number, {headers}: {headers?: Record<string, string>} = {}) {
+  await apiRetry(() => requestContext.post(`${baseUrl()}/api/v1/repos/${owner}/${repo}/issues/${issueIndex}/stopwatch/start`, {
+    headers: headers || apiHeaders(),
+  }), 'apiStartStopwatch');
+}
+
 export async function apiDeleteRepo(requestContext: APIRequestContext, owner: string, name: string) {
-  await apiRetry(() => requestContext.delete(`${apiBaseUrl()}/api/v1/repos/${owner}/${name}`, {
+  await apiRetry(() => requestContext.delete(`${baseUrl()}/api/v1/repos/${owner}/${name}`, {
     headers: apiHeaders(),
   }), 'apiDeleteRepo');
 }
 
 export async function apiDeleteOrg(requestContext: APIRequestContext, name: string) {
-  await apiRetry(() => requestContext.delete(`${apiBaseUrl()}/api/v1/orgs/${name}`, {
+  await apiRetry(() => requestContext.delete(`${baseUrl()}/api/v1/orgs/${name}`, {
     headers: apiHeaders(),
   }), 'apiDeleteOrg');
 }
 
+/** Generate a random password that satisfies the complexity requirements. */
+function generatePassword() {
+  const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+  return `${Array.from(randomBytes(12), (b) => chars[b % chars.length]).join('')}!aA1`;
+}
+
+/** Random password shared by all test users — used for both API user creation and browser login. */
+const testUserPassword = generatePassword();
+
+export function apiUserHeaders(username: string) {
+  return apiAuthHeader(username, testUserPassword);
+}
+
+export async function apiCreateUser(requestContext: APIRequestContext, username: string) {
+  await apiRetry(() => requestContext.post(`${baseUrl()}/api/v1/admin/users`, {
+    headers: apiHeaders(),
+    data: {username, password: testUserPassword, email: `${username}@${env.GITEA_TEST_E2E_DOMAIN}`, must_change_password: false},
+  }), 'apiCreateUser');
+}
+
+export async function apiDeleteUser(requestContext: APIRequestContext, username: string) {
+  await apiRetry(() => requestContext.delete(`${baseUrl()}/api/v1/admin/users/${username}?purge=true`, {
+    headers: apiHeaders(),
+  }), 'apiDeleteUser');
+}
+
 export async function clickDropdownItem(page: Page, trigger: Locator, itemText: string) {
   await trigger.click();
   await page.getByText(itemText).click();
 }
 
+export async function loginUser(page: Page, username: string) {
+  return login(page, username, testUserPassword);
+}
+
 export async function login(page: Page, username = env.GITEA_TEST_E2E_USER, password = env.GITEA_TEST_E2E_PASSWORD) {
   await page.goto('/user/login');
   await page.getByLabel('Username or Email Address').fill(username);