v0.5.2 — Playwright E2E + permit-deny fix

SheetDiff v0.5.2 — Playwright E2E + two accounting-bug fixes

The second dev-environment pass added the last recommended item — a Playwright smoke E2E suite — and the audit that accompanied it surfaced two pre-existing bugs with real accounting impact, both fixed.

Fixed

• The permit deny-list failed open. A regex typo (nots+ for not\s+) meant "Not Issued", "Not Approved", and "Not Released" matched the approved vocabulary — placed-under-unapproved findings were silently missed on exactly the permits that say no. Negations are denied now, with the vocabulary pinned by tests.
• Header drift could key history by the wrong column. SheetDiff's identity columns resolve once on latest data — but they're indices, and a column inserted or removed since a baseline shifts every index after it. The history walk now drops to content identity whenever the slice's header at a resolved index isn't the column the latest walk keyed on.
• Smaller: day-family headers ("Day No") join date/week as date-ish (a day-number column no longer collapses two same-week logs into one); the Google token refresh preserves the stored access token; coverage thresholds carry ~1% of ratchet margin.

New: Playwright smoke E2E

Five tests against the production build (not next dev): health endpoint, the public landing page, demo login → dashboard, the sheet diff view with its changes-since-collection bar, and the report + billing pages. The suite boots on its own port with a throwaway temp-dir database — it can never touch a real one — and the CI job uploads the HTML report on failure. Run locally with npm run test:e2e.

Also: typecheck now runs next typegen first (Next 16's own recommendation), a db:studio script (Drizzle Studio), a CI badge in the README, and the docker boot-probe job builds arm64 alongside x64 — free on public repos, and it matches how self-hosters actually deploy this (NAS, Raspberry Pi).

370 tests + 5 E2E, all green in CI. Node 22+.