chore: reorganize test files into domain-specific subdirectories under tests/

Split the monolithic test directory into three tiers (unit, api, e2e) with a path-mirroring directory structure. Added corresponding Makefile targets (test-unit, test-api, test-e2e) and updated all documentation references (CLAUDE.md, README.md, testing-cicd.html, testing-framework.html, testing-make.html) to reflect the new layout and naming conventions.

tests/e2e/xss.py

@@ -0,0 +1,37 @@
+# retoor <retoor@molodetz.nl>
+
+from tests.e2e.post import create_post
+POST_PAYLOAD = (
+    "XSSPROBE <img src=x onerror=alert('p')><script>alert('s')</script> end of post"
+)
+COMMENT_PAYLOAD = (
+    "CMTPROBE <img src=x onerror=alert('c')><script>alert('s')</script> end of comment"
+)
+
+
+def test_post_content_is_sanitized(alice):
+    page, _ = alice
+    fired = []
+    page.on("dialog", lambda d: (fired.append(d.message), d.dismiss()))
+    create_post(page, "random", POST_PAYLOAD)
+    content = page.locator(".post-detail-content")
+    content.wait_for(state="visible")
+    page.locator(".post-detail-content p").first.wait_for(state="visible")
+    assert content.locator("script").count() == 0
+    assert content.locator("[onerror]").count() == 0
+    assert not fired, f"XSS payload executed: {fired}"
+
+
+def test_comment_content_is_sanitized(alice):
+    page, _ = alice
+    fired = []
+    page.on("dialog", lambda d: (fired.append(d.message), d.dismiss()))
+    create_post(page, "random", "Clean host post for comment sanitization")
+    page.locator(".comment-form textarea[name='content']").fill(COMMENT_PAYLOAD)
+    page.locator(".comment-form button:has-text('Post')").click()
+    comment = page.locator(".comment-text:has-text('CMTPROBE')")
+    comment.wait_for(state="visible")
+    page.locator(".comment-text p").first.wait_for(state="visible")
+    assert comment.locator("script").count() == 0
+    assert comment.locator("[onerror]").count() == 0
+    assert not fired, f"XSS payload executed: {fired}"