e2e: Playwright suite for homepage + guard chain; RBAC gate on /admin; fix stale service links

tests/e2e/run.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Playwright e2e for the homepage and the Anubis -> Authentik guard chain.
+# Drives the LIVE fleet, so it needs real credentials and is deliberately NOT
+# part of ./tests/run.sh. Credentials live in tests/e2e/.env.local
+# (git-ignored; see .env.local.example). Usage:
+#
+#   tests/e2e/run.sh                  # full suite
+#   tests/e2e/run.sh --project guest  # any playwright args pass through
+set -euo pipefail
+cd "$(dirname "$0")"
+
+if [ ! -f .env.local ]; then
+    echo "tests/e2e/.env.local missing — copy .env.local.example and fill in the IdP credentials" >&2
+    exit 1
+fi
+
+if [ ! -d node_modules ]; then
+    if [ -f package-lock.json ]; then
+        npm ci --no-audit --no-fund
+    else
+        npm install --no-audit --no-fund
+    fi
+fi
+
+npx playwright install chromium
+
+exec npx playwright test "$@"