✨ tests: add binary e2e suite (Traefik binary + Go mock LAPI), run it in CI

Add a second e2e suite that runs Traefik as a downloaded binary with the
plugin loaded from source, and replaces Crowdsec with a small stdlib-only Go
LAPI mock driven via /admin endpoints. No Docker, no real Crowdsec.

The mock lives in its own nested Go module (tests/e2e/mock/mocklapi) so it
stays out of the plugin module's build, lint, test and vendor.

This suite validates the plugin's own behaviour (live/none/stream modes,
caching, trusted-IP bypass, ban/captcha rendering). Crowdsec and AppSec
correctness are out of scope on purpose — they are validated upstream by the
maintainer — so the AppSec scenario is intentionally absent and the README
says so to avoid misfiled issues.

CI now runs this suite only (`make e2e_mock`), since it needs neither Docker
nor a real Crowdsec. The Docker suite (tests/e2e/scenarios) is kept for local
debugging (`make e2e`).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/e2e/mock/lib/traefik.yml

@@ -0,0 +1,28 @@
+# Static Traefik configuration for the binary e2e suite.
+# The dynamic part (router + bouncer middleware + backend service) lives in
+# dynamic.yml, generated per scenario by common.sh.
+entryPoints:
+  web:
+    address: ":8000"
+    forwardedHeaders:
+      # The test's curl sets X-Forwarded-For; preserve it through the proxy.
+      insecure: true
+
+log:
+  level: INFO
+
+accessLog: {}
+
+# /ping on the web entrypoint is the readiness probe — no dashboard/API needed.
+ping:
+  entryPoint: web
+
+providers:
+  file:
+    filename: dynamic.yml
+    watch: false
+
+experimental:
+  localPlugins:
+    bouncer:
+      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin