Fix report persistence, search API, Playwright CI and open redirect

[Nimatstar]

Summary

This PR addresses four frontend issues with small, focused changes:

#1617 - Report builder saved reports persistence

• Created frontend/lib/api/saved-reports.ts with a typed API client for the saved-reports resource (list, create, rename, delete, duplicate).
• Updated reports/builder/page.tsx to load saved reports from the API on mount and persist new reports through the API (with a local fallback if the backend is not yet available).

#1607 - Global search bypasses API client and auth

• Created frontend/lib/api/search.ts using the shared axios instance (correct base URL + auth token).
• Updated search/page.tsx to call searchApiClient.search() instead of raw fetch('/api/search'), including an abort signal for cancellation.

#1606 - Playwright e2e suite not run in CI

• Added an e2e job to frontend-ci.yml that installs browsers (npx playwright install --with-deps chromium), builds the app, runs npm run test:e2e, and uploads HTML report + traces on failure.
• Fixed the build env NEXT_PUBLIC_API_URL to use port 6003 (the backend default).

#1604 - Open redirect via unvalidated redirect query param

• Created frontend/lib/utils/redirect-validation.ts with getSafeRedirect() that rejects absolute, protocol-relative, backslash, and encoded-scheme variants, falling back to /dashboard.
• Updated login/page.tsx to use getSafeRedirect() instead of passing the raw query param to router.push().

Closes #1617
Closes #1607
Closes #1606
Closes #1604

[drips-wave]

@Nimatstar Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@Nimatstar is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.