e2e: Playwright suite for homepage + guard chain; RBAC gate on /admin; fix stale service links

tests/e2e/specs/10-homepage.spec.ts

@@ -0,0 +1,40 @@
+import { expect, test } from "@playwright/test";
+
+// The user-facing homepage as a standard (non-admin) authenticated user.
+
+test("user homepage renders only user-category services", async ({ page }) => {
+  await page.goto("/");
+  await expect(page).toHaveTitle(/frank — services/);
+
+  const names = await page.locator("#grid .panel .name").allTextContents();
+  expect(names.length).toBeGreaterThanOrEqual(9);
+  for (const wanted of ["SearXNG", "OpenWebUI", "Gitea", "RomM", "Jellyfin", "Seerr"]) {
+    expect(names, `user panel for ${wanted}`).toContain(wanted);
+  }
+  for (const adminOnly of ["Grafana", "Prometheus", "Loki", "Hermes"]) {
+    expect(names, `admin service ${adminOnly} must not leak into user grid`).not.toContain(adminOnly);
+  }
+});
+
+test("user homepage exposes exactly the registry's open links", async ({ page }) => {
+  await page.goto("/");
+  await expect(page.locator("#grid a.open")).toHaveCount(9);
+
+  const hrefs = await page.locator("#grid a.open").evaluateAll((els) =>
+    els.map((el) => (el as HTMLAnchorElement).getAttribute("href")),
+  );
+  for (const href of hrefs) {
+    expect(href, "links use current vhost names").not.toMatch(/chat\.|jellyfin\.|comfyui\./);
+  }
+});
+
+test("standard user is denied the admin panel (RBAC)", async ({ page }) => {
+  const resp = await page.request.get("/admin/");
+  expect(resp.status()).toBe(403);
+  expect(await resp.text()).toContain("Forbidden: homepage admins only");
+
+  // The footer link a standard user can click also dead-ends at the gate.
+  await page.goto("/");
+  await page.locator('footer a[href="/admin/"]').click();
+  await expect(page.locator("body")).toContainText("Forbidden: homepage admins only");
+});