tests(e2e): Refactor various tests

Goals:

- speedup
- less flakiness
- best practices and more use
- documentation

config:
- sync ports in Makefile and playwright config
  (otherwise, some tests fail locally because they assert the full URL including the (wrong) port)
- even more generous timeouts
- limit workers to one again (because I finally understand how
  Playwright works)
- allow nested functions to group them together with the related test

all:

- deprecate waitForLoadState('networkidle')
  - it is discouraged as per https://playwright.dev/docs/api/class-page#page-wait-for-load-state
  - I could not find a usage that seems to require it actually (see
    added documentation in README)
  - adding an exception should be made explicitly
  - it does not do what you might expect anyway in most cases
- only log in when necessary

webauthn:

- verify that login is possible after disabling key
- otherwise, the cleanup was not necessary after the previous refactor to create a fresh user each

issue-sidebar / WIP toggle:

- split into smaller chunks
- restore original state first
- add missed assertion to fix race condition (not waiting
  before state was reached)
- explicitly toggle the state to detect mismatch earlier

issue-sidebar / labels:

- restore original state first
- better waiting for background request

tests/e2e/webauthn.test.e2e.ts

@@ -8,7 +8,7 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, create_temp_user} from './utils_e2e.ts';
+import {test, create_temp_user, login_user} from './utils_e2e.ts';
 
 test('WebAuthn register & login flow', async ({browser, request}, workerInfo) => {
   test.skip(workerInfo.project.name !== 'chromium', 'Uses Chrome protocol');
@@ -38,8 +38,10 @@ test('WebAuthn register & login flow', async ({browser, request}, workerInfo) =>
   await page.getByText('Add security key').click();
 
   // Logout.
-  await page.locator('div[aria-label="Profile and settings…"]').click();
-  await page.getByText('Sign Out').click();
+  await expect(async () => {
+    await page.locator('div[aria-label="Profile and settings…"]').click();
+    await page.getByText('Sign Out').click();
+  }).toPass();
   await page.waitForURL(`${workerInfo.project.use.baseURL}/`);
 
   // Login.
@@ -57,5 +59,8 @@ test('WebAuthn register & login flow', async ({browser, request}, workerInfo) =>
   expect(response?.status()).toBe(200);
   await page.getByRole('button', {name: 'Remove'}).click();
   await page.getByRole('button', {name: 'Yes'}).click();
-  await page.waitForURL(`${workerInfo.project.use.baseURL}/user/settings/security`);
+  await page.waitForLoadState();
+
+  // verify the user can login without a key
+  await login_user(browser, workerInfo, username);
 });