e2e: Playwright suite for homepage + guard chain; RBAC gate on /admin; fix stale service links

tests/e2e/lib/env.ts

@@ -0,0 +1,39 @@
+import { readFileSync } from "node:fs";
+
+// Parses tests/e2e/.env.local (git-ignored) into a plain record. Returns {}
+// when the file is absent so config load never crashes before a useful error.
+export function loadEnvFile(): Record<string, string> {
+  try {
+    const raw = readFileSync(new URL("../.env.local", import.meta.url), "utf8");
+    const out: Record<string, string> = {};
+    for (const line of raw.split("\n")) {
+      const m = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*)\s*$/);
+      if (m) out[m[1]] = m[2];
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+
+const env = loadEnvFile();
+
+export const BASE_URL = process.env.E2E_BASE_URL || env.E2E_BASE_URL || "https://www.franksdank.cloud";
+
+// Anubis challenges obvious headless UAs; present as a stock Chrome.
+export const REAL_UA =
+  "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36";
+
+function credential(name: string): string {
+  const v = process.env[name] || env[name];
+  if (!v) throw new Error(`missing ${name} — set it in tests/e2e/.env.local or the environment`);
+  return v;
+}
+
+export function standardCredentials(): { user: string; pass: string } {
+  return { user: credential("E2E_STANDARD_USER"), pass: credential("E2E_STANDARD_PASS") };
+}
+
+export function adminCredentials(): { user: string; pass: string } {
+  return { user: credential("E2E_ADMIN_USER"), pass: credential("E2E_ADMIN_PASS") };
+}