Fix CI DinD networking: replace host mode with compose-internal Playwright

The test-runners job was failing because network_mode: host puts the
armature container on DinD's network namespace, unreachable from the
workflow container which is on a separate bridge network.

Fix: Remove host networking entirely. Add a test-runner service to the
CI compose override that runs Playwright tests on the same bridge
network as armature, using Docker DNS (http://armature:80).

Changes:
- docker-compose.ci.yml: Replace network_mode: host with healthcheck
  on armature + Playwright test-runner service (depends_on: healthy)
- ci.yaml: Collapse 7 test-runners steps into 3 (checkout, compose
  up --exit-code-from test-runner, teardown)

docker-compose.ci.yml

@@ -1,7 +1,44 @@
-# CI override — uses host networking so the container is reachable
-# from the Gitea runner pod without cross-network routing.
+# docker-compose.ci.yml — CI test override
 #
-# Usage: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d
+# Extends base docker-compose.yml. Adds a healthcheck to armature and a
+# Playwright test-runner service.  All containers share the default compose
+# bridge network, so the test-runner reaches armature via Docker DNS
+# (http://armature:80).
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+#     --abort-on-container-exit --exit-code-from test-runner
+#
+# The workflow exits with the test-runner's exit code (0 = pass, 1 = fail).
+#
+# NOTE: Do NOT use network_mode: host — the workflow container and compose
+# containers are in separate network namespaces inside DinD. Use the default
+# bridge network and let services talk via Docker DNS instead.
+
 services:
   armature:
-    network_mode: host
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:80/api/v1/auth/login"]
+      interval: 2s
+      timeout: 3s
+      retries: 30
+      start_period: 5s
+
+  test-runner:
+    image: mcr.microsoft.com/playwright:v1.52.0-noble
+    depends_on:
+      armature:
+        condition: service_healthy
+    working_dir: /work
+    volumes:
+      - .:/work
+    environment:
+      SERVER_URL: http://armature:80
+      ADMIN_USER: admin
+      ADMIN_PASS: admin
+    command:
+      - bash
+      - -c
+      - |
+        npm install --no-save playwright 2>/dev/null
+        ./ci/run-surface-tests.sh