e2e: Playwright suite for homepage + guard chain; RBAC gate on /admin; fix stale service links

tests/e2e/specs/00-auth.setup.ts

@@ -0,0 +1,21 @@
+import { test as setup } from "@playwright/test";
+import { BASE_URL, adminCredentials, standardCredentials } from "../lib/env";
+import { akLogin, launchOptions } from "../lib/login";
+
+// One setup test per identity; each uses a FRESH context so authentik's
+// pending_user stage is never shared between logins. Storage states land in
+// .auth/ (git-ignored) and back the `standard` and `admin` projects.
+const legs = [
+  { key: "qa-e2e", creds: standardCredentials() },
+  { key: "qa-e2e-admin", creds: adminCredentials() },
+];
+
+for (const leg of legs) {
+  setup(`login ${leg.key}`, async ({ browser }) => {
+    const context = await browser.newContext(launchOptions());
+    const page = await context.newPage();
+    await akLogin(page, BASE_URL, leg.creds.user, leg.creds.pass);
+    await page.context().storageState({ path: `.auth/${leg.key}.json` });
+    await context.close();
+  });
+}