e2e: Playwright suite for homepage + guard chain; RBAC gate on /admin; fix stale service links

tests/e2e_scaffold.bats

@@ -0,0 +1,48 @@
+#!/usr/bin/env bats
+# Seam: tests/e2e — Playwright suite structure. The suite drives the LIVE
+# fleet (homepage + Anubis/Authentik guard chain) and is deliberately not
+# part of ./tests/run.sh; this seam only asserts the scaffold is present,
+# well-formed, and that no credentials or browser auth state are tracked.
+
+load helpers
+
+@test "e2e: runner, config, lib, and specs exist" {
+    for f in run.sh package.json playwright.config.ts .env.local.example \
+             lib/env.ts lib/login.ts \
+             specs/00-auth.setup.ts specs/10-homepage.spec.ts specs/11-admin.spec.ts \
+             specs/12-crawl.spec.ts specs/13-sso.spec.ts specs/14-guard.spec.ts; do
+        [ -f "$REPO_ROOT/tests/e2e/$f" ] || {
+            echo "missing tests/e2e/$f"
+            return 1
+        }
+    done
+}
+
+@test "e2e: package.json is valid JSON with the playwright dependency" {
+    python3 - "$REPO_ROOT/tests/e2e/package.json" <<'PY'
+import json, sys
+pkg = json.load(open(sys.argv[1]))
+assert "@playwright/test" in pkg.get("devDependencies", {}), "missing @playwright/test"
+PY
+}
+
+@test "e2e: run.sh parses" {
+    bash -n "$REPO_ROOT/tests/e2e/run.sh"
+}
+
+@test "e2e: example env file carries only placeholders" {
+    if grep -E '^E2E_[A-Z_]*PASS=' "$REPO_ROOT/tests/e2e/.env.local.example" | grep -vq REPLACE_ME; then
+        echo ".env.local.example must hold REPLACE_ME placeholders, never real passwords"
+        return 1
+    fi
+}
+
+@test "e2e: no credentials or auth state are tracked" {
+    cd "$REPO_ROOT"
+    tracked="$(git ls-files tests/e2e)"
+    if echo "$tracked" | grep -Eq '(^|/)\.env\.local$|(^|/)\.auth(/|$)|node_modules'; then
+        echo "tracked files must not include creds or auth state:"
+        echo "$tracked" | grep -E '(^|/)\.env\.local$|(^|/)\.auth(/|$)|node_modules'
+        return 1
+    fi
+}