refactor: reorganize test suite, add integration tests for NAT filter

- Move integration tests (api, network, phase2, smoke) to tests/integration/
- Move Playwright specs (captive-portal, interop-happy-path) to tests/e2e/
- Move playwright.config.mjs to tests/e2e/
- Fix hardcoded IP fallbacks: 192.168.4.1 → 10.192.45.1
- Add test-reset-auth.mjs: reset→pay→allow→revoke→block cycle
- Add test-session-expiry.mjs: pay→wait 65s→verify blocked (slow test)
- Add test-dns-firewall.mjs: DNS hijack/forward + per-client NAT filter
- Update Makefile with test-unit, test-integration, test-e2e, test-all targets
- Update package.json scripts for new paths
- Fix Playwright video: retain-on-failure instead of always-on
- Update AGENTS.md: per-client NAT filter description
- Update CHECKLIST.md: mark completed items, add Board B identity
- Board B nsec: 9af47906... → SSID TollGate-b96d80, AP IP 10.185.47.1
- 186 unit tests passing

1 files changed, 2 insertions, 2 deletions

diff --git a/AGENTS.md b/AGENTS.md
index f5d4f7e..6f1c399 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -51,8 +51,8 @@ nvs_flash_init()
 - `wifistr.c/h` — kind 38787 event builder + WebSocket relay publish
 - `captive_portal.c/h` — HTTP :80 portal, captive detection, grant/reset
 - `dns_server.c/h` — DNS hijack/forward per-client, DoT reject
-- `firewall.c/h` — NAPT on/off per-client, MAC resolution
-- `session.c/h` — time-based sessions, spent-secret tracking
+- `firewall.c/h` — per-client NAT filter via LWIP_HOOK_IP4_CANFORWARD, MAC resolution
+- `session.c/h` — time-based sessions, MAC tracking
 - `cashu.c/h` — Cashu token decode, checkstate, allotment calc
 - `tollgate_api.c/h` — HTTP :2121, payment endpoints, wallet endpoints