Add generic e2e infrastructure for tier-gated and experimental features

[hatton]

Problem

An end-to-end test (the Playwright suite in src/BloomE2E) could not reach three kinds of Bloom behaviour. A feature behind a subscription tier stayed hidden, because the test collection had no subscription. A feature behind an experimental-feature token could only be turned on by writing the shared user.config, which would also turn it on for the developer's own Bloom. And anything that opens a native file or folder chooser hung the run, because no automation can drive that dialog. A branch that needed all three had built them for itself, along with helpers for the Canvas tool, page layout, page size, images and undo; this PR lands the generic parts on their own, with nothing specific to any one feature.

What the PR does

• Bloom accepts --experimental-features <tokens> together with --e2e. Under --e2e the enabled features are exactly those tokens: they are never saved, and the developer's own saved experiments do not reach the run, so a test that needs a feature off gets it off by not naming it. Saving a feature from such a run leaves the saved setting as it was.
• A test arms the next file or folder chooser with a path through the e2e/nextFileToChoose route. BloomOpenFileDialog and BloomFolderChooser answer with that path instead of showing a dialog, only under --e2e, once per arming. A missing file or one the filter would refuse throws. This is now the one such hook: the narrower one master had added for the Talking Book import goes through it, and under --e2e the file API no longer remembers a test's folder in the developer's machine-wide settings.
• Under --e2e, Bloom no longer probes port 5173 for a Vite dev server, and refuses camera and microphone permission requests, which on a fresh browser profile would otherwise show a WebView2 prompt no test can dismiss.
• The suite's launcher takes subscriptionCode and experimentalFeatures options, logs which Bloom.exe it runs and when that file was built, and refuses to launch a Bloom whose front-end bundle or Bloom.dll is older than its source, naming the newer file. A stale build would otherwise fail a test exactly the way a regression does. Tier-gated specs use the existing test code from SubscriptionTests.cs; the Test branding now stamps a butterfly on every page so such a book is visibly a test book.
• New helpers cover the toolbox, the Canvas tool (opened by clicking the canvas, palette drags, the element menu and toolbar), Change Layout mode, page size and orientation, key-by-key typing, geometry, feature status, undo, and importing a video through the Sign Language tool with the chooser hook. The image helpers take an optional scope, so a test can act on a picture box other than the page's first.
• Palette items and menu items carry test ids. A tier-gated menu item is marked as such, because it stays clickable and so has no disabled class, and it marks itself while it is still waiting to hear whether its feature is on offer, so the menu helper can wait for the answer before reporting what is enabled.

Devin review

---

This change is 

[hatton]

[Claude Fable 5.1 from Hatton's machine during preflight] Consulted Devin on 2026-09-04 22:15 UTC up to commit abbe372.

Devin found no bugs. It raised one Investigate flag, about the palette drag being dispatched rather than driven with the real mouse; that is a documented exception, and the thread records why: #8314 (comment). No informational items. CI (pr-automation) passed.

Devin review: https://app.devin.ai/review/BloomBooks/BloomDesktop/pull/8314

[hatton]

[Claude Fable 5.1 from Hatton's machine during preflight]

Consulted Devin (review page) up to ded01e4627, the head of this preflight run. Over the run's seven reviewed commits it raised eight bugs and five Investigate flags, no Informational flags; every one has its own thread with the outcome recorded and is resolved:

• Saved experiments leaked into --e2e runs: fixed in 7df51db (thread; a duplicate post of the same finding is here).
• Tier-gated menu items could be read before their feature status arrived: fixed in 7df51db (thread).
• SetValue could save a feature twice under --e2e: fixed in 7afde6f (thread).
• A feature token was matched as a substring, so not-team-collections enabled Team Collections: fixed in f5a86bf (thread).
• The new stale-build check counted tests and docs as source, missed .uitest.ts files, ignored the Markdown the build compiles, and scanned only the front-end tree: fixed across f5a86bf, 003e695 and ded01e4 (1, 2, 3, 4).
• The launcher's comment still described the port 5173 probe: fixed in 7df51db (thread).
• The stale-build refusal told the reader to run pnpm build, which AGENTS.md reserves for the developer: reworded in f5a86bf (thread).
• The newest Bloom.exe in any configuration is the one tested: the launcher now logs which one and when it was built (thread).
• The palette drag is dispatched rather than driven by the real mouse: a documented exception, not changed (thread).
• Startup still runs the settings migration under --e2e: not an issue, it writes only what the developer's own Bloom writes at every start (thread).

Devin's report for each later commit repeats the earlier findings unchanged alongside the new ones. CI (pr-automation) passed for every commit. CodeRabbit has a config file in the repo but posted nothing.