test(e2e): prove guard chain blocks direct navigation and admins keep admin reach

14-guard.spec.ts: every authentik-guarded vhost (www, search, romm, files,
seerr, grafana, prometheus, loki) must challenge an unauthenticated direct
navigation; plex is asserted exempt (PMS answers directly, no IdP form).
11-admin.spec.ts: admin direct-nav to grafana/prometheus/loki passes through
with host preserved and no uidField challenge.

tests/e2e/specs/11-admin.spec.ts

@@ -47,3 +47,23 @@ test("admin open links reach their apps through SSO", async ({ page }) => {
     expect(resp.status(), `${target.hostname} must answer, not error`).toBeLessThan(500);
   }
 });
+
+// Admin-space reachability must not depend on the panel's link list: an admin
+// session must reach every guarded admin app by direct navigation, even where
+// no open-link exists. This is the RBAC allow-leg for the outpost gates: an
+// authenticated admin always lands in the app, never on a login wall or a 403.
+test("admin direct navigation reaches every admin app without an auth wall", async ({ page }) => {
+  test.setTimeout(240_000);
+  for (const sub of ["grafana", "prometheus", "loki"]) {
+    const host = `${sub}.franksdank.cloud`;
+    await page.goto(`https://${host}/`);
+    // The outpost hands off silently for an authenticated session; the admin
+    // must land in the app, not on authentik's flow UI.
+    await expect
+      .poll(() => page.locator('input[name="uidField"]').isVisible().catch(() => false), { timeout: 60_000 })
+      .toBe(false);
+    expect(new URL(page.url()).hostname, `${host} must not bounce an admin off its host`).toBe(host);
+    const resp = await page.request.get(`https://${host}/`);
+    expect(resp.status(), `${host} must answer an authenticated admin, not error`).toBeLessThan(500);
+  }
+});