✨ tests: add binary e2e suite (Traefik binary + Go mock LAPI), run it in CI

Add a second e2e suite that runs Traefik as a downloaded binary with the
plugin loaded from source, and replaces Crowdsec with a small stdlib-only Go
LAPI mock driven via /admin endpoints. No Docker, no real Crowdsec.

The mock lives in its own nested Go module (tests/e2e/mock/mocklapi) so it
stays out of the plugin module's build, lint, test and vendor.

This suite validates the plugin's own behaviour (live/none/stream modes,
caching, trusted-IP bypass, ban/captcha rendering). Crowdsec and AppSec
correctness are out of scope on purpose — they are validated upstream by the
maintainer — so the AppSec scenario is intentionally absent and the README
says so to avoid misfiled issues.

CI now runs this suite only (`make e2e_mock`), since it needs neither Docker
nor a real Crowdsec. The Docker suite (tests/e2e/scenarios) is kept for local
debugging (`make e2e`).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -1,8 +1,11 @@
-.PHONY: lint test vendor clean e2e
+.PHONY: lint test vendor clean e2e e2e_mock
 
 export GO111MODULE=on
 
+# Docker suite (real Traefik + Crowdsec). Kept for local debugging.
 E2E_SCENARIOS := stream-mode live-mode none-mode trusted-ips custom-ban-page captcha appsec
+# Binary/mock suite (Traefik binary + mock LAPI). This is what CI runs.
+E2E_MOCK_SCENARIOS := stream-mode live-mode none-mode trusted-ips custom-ban-page captcha
 
 default: lint test
 
@@ -20,6 +23,11 @@ e2e: $(addprefix e2e_,$(E2E_SCENARIOS))
 e2e_%:
 	./tests/e2e/scenarios/$*/run.sh
 
+e2e_mock: $(addprefix e2e_mock_,$(E2E_MOCK_SCENARIOS))
+
+e2e_mock_%:
+	./tests/e2e/mock/scenarios/$*/run.sh
+
 vendor:
 	go mod vendor