e2e: Playwright suite for homepage + guard chain; RBAC gate on /admin; fix stale service links

tests/e2e/specs/14-guard.spec.ts

@@ -0,0 +1,14 @@
+import { expect, test } from "@playwright/test";
+
+// With no session at all, the guard chain must demand authentik login for
+// both homepage faces. This is the outer wall the whole e2e suite assumes.
+
+test("unauthenticated homepage visit requires authentik login", async ({ page }) => {
+  await page.goto("/");
+  await expect(page.locator('input[name="uidField"]')).toBeVisible({ timeout: 90_000 });
+});
+
+test("unauthenticated /admin requires authentik login", async ({ page }) => {
+  await page.goto("/admin/");
+  await expect(page.locator('input[name="uidField"]')).toBeVisible({ timeout: 90_000 });
+});