Harden NordVPN reconciliation and WebGUI testing

tests/ui/run-opnsense.sh

@@ -0,0 +1,75 @@
+#!/bin/sh
+
+set -eu
+umask 077
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+runtime_dir="$script_dir/.runtime"
+launcher_file="$runtime_dir/launcher.pid"
+mkdir -p "$runtime_dir"
+
+if [ -r "$launcher_file" ]; then
+    read -r existing_launcher < "$launcher_file"
+    case "$existing_launcher" in
+        *[!0-9]* | '') ;;
+        *)
+            if kill -0 "$existing_launcher" 2>/dev/null; then
+                echo "An OPNsense UI fixture is already running." >&2
+                exit 1
+            fi
+            ;;
+    esac
+fi
+
+cleanup()
+{
+    status=$?
+    set +e
+    if [ "$status" -ne 0 ] && [ "${OPNSENSE_UI_KEEP_VM_ON_FAILURE:-1}" = '1' ]; then
+        printf '%s\n' "OPNSENSE_UI_VM_RETAINED=$runtime_dir"
+        trap - EXIT
+        exit "$status"
+    fi
+    [ -n "${launcher_pid:-}" ] && kill "$launcher_pid" 2>/dev/null
+    [ -n "${launcher_pid:-}" ] && wait "$launcher_pid" 2>/dev/null
+    rm -f "$runtime_dir/launcher.log"
+}
+trap cleanup EXIT INT TERM
+
+"$script_dir/start-opnsense.sh" > "$runtime_dir/launcher.log" 2>&1 &
+launcher_pid=$!
+
+attempts=240
+while [ ! -f "$runtime_dir/ready" ]; do
+    if ! kill -0 "$launcher_pid" 2>/dev/null; then
+        cat "$runtime_dir/launcher.log" >&2
+        exit 1
+    fi
+    attempts=$((attempts - 1))
+    [ "$attempts" -gt 0 ] || {
+        cat "$runtime_dir/launcher.log" >&2
+        exit 1
+    }
+    sleep 1
+done
+
+set -a
+. "$runtime_dir/credentials.env"
+set +a
+
+attempts=60
+while ! curl --fail --insecure --silent --connect-timeout 2 "$OPNSENSE_UI_BASE_URL/" > /dev/null; do
+    if ! kill -0 "$launcher_pid" 2>/dev/null; then
+        cat "$runtime_dir/launcher.log" >&2
+        exit 1
+    fi
+    attempts=$((attempts - 1))
+    [ "$attempts" -gt 0 ] || {
+        cat "$runtime_dir/launcher.log" >&2
+        exit 1
+    }
+    sleep 1
+done
+
+pnpm --dir "$script_dir" install --frozen-lockfile
+pnpm --dir "$script_dir" test