Add integration tests on WordPress Playground #2

The 94 existing PHPUnit tests all dispatch in-process (WP_REST_Server::dispatch()) or call PHP directly. Nothing exercises a real browser: not the login/consent redirect flow, not wp_redirect() to the client, not bearer auth over real HTTP. That's exactly where interception and CSRF bugs live, and where PKCE (#1) needs to be proven end to end.

Proposed environment: WordPress Playground, not wp-env — no Docker, boots in seconds, blueprint-defined so CI and local match, and gives shareable PR preview links. It suits this plugin (post meta and user meta only, no custom tables, so SQLite is fine). wp-env stays the fallback if we hit something Playground can't do (real MySQL semantics, multisite, or a PHP version it doesn't ship) — the existing PHPUnit matrix already covers PHP/WP versions and multisite, so Playground doesn't need to.

Shape of the work:

• package.json with @playwright/test and @wp-playground/cli; playwright.config.ts.
• tests/e2e/blueprint.json — mount and activate the plugin, pretty permalinks, an admin and a subscriber user.
• A small test mu-plugin serving the OAuth2 client callback from inside Playground, so redirects land on an assertable local URL and the suite runs offline.
• Specs for the real flows: register/approve a client through the admin UI; full authorization_code + PKCE S256 through login and consent, then use the token; client_credentials; implicit; personal access tokens created and revoked from the profile page.
• A security-tagged spec for cases that must keep failing: wrong/missing PKCE verifier, plain against a PKCE-required client, unsupported/wrongly-cased method, code replay, expired code, cross-client code use, redirect_uri mismatch, unapproved client, revoked token, bad consent nonce, implicit grant against a PKCE-required client, state round-tripped unchanged.
• An e2e job in .github/workflows/tests.yml, with traces/HTML report as artifacts on failure.
• A PR-preview comment with a Playground blueprint link.
• CONTRIBUTING.md covering how to run each test layer (currently only discoverable from the CI workflow or the PHPUnit bootstrap's error message), and a composer test script.