expand the end-to-end suite to cover every authenticated route

[joshunrau]

Expands the Playwright suite from the handful of flows it covered to every authenticated route in apps/web, and adds a server-side authorization block that drives the API directly.

New coverage

Spec	Covers
static-pages	/about release info (web, API, gateway healthcheck), /contact validation and its mailto link, unauthenticated redirects for both
user-profile	Profile fields, updating one without a reload, password strength/confirmation rules, changing a password and logging back in with it
subject-detail	Graph tab plotting a measure, assignments tab listing and cancelling a remote assignment, opening a record from the table
upload	Uploading a valid CSV and finding the subject it created, and the validation-error + retry path
group-manage	Previewing an accessible instrument, and saving instrument selection + group settings so they survive navigation
admin-settings	Toggling the uploader feature through to the sidebar, and the group-switcher position preference
admin-branding	Navigating to the login-page editor and persisting a branding change
admin-instrument-repos	The repos page and client-side URL validation (a successful import would clone from GitHub, so it is out of scope)
admin-audit-logs	The table, filtering to a login it triggers itself, and the JSON download
accessible-instruments	Search filtering the instrument showcase
authorization	Extended — see below

admin-management, auth, dashboard, datahub, disclaimer, gateway-assignment, instrument-completion, remote-assignment and start-session all gained cases as well.

Server-side authorization

_app/route.tsx's beforeLoad checks that a token exists, not what role holds it, and no route under /admin adds a check of its own — so a non-admin who navigates there directly gets the real screen (#1470). What actually protects those screens is the API, so authorization.spec.ts now asserts that half directly rather than through the UI:

• Every privileged request those screens fire (POST/PATCH/DELETE /v1/users, PATCH /v1/setup, POST /v1/instrument-repos, GET /v1/audit/logs) returns 403 for both GROUP_MANAGER and STANDARD.
• A group manager cannot rename or delete a group they do not belong to — asserted by effect, since @RouteAccess sees only the subject type there and the row scoping in GroupsService is the whole check.
• Read scoping: GET /v1/users returns only the acting user's own group for a GROUP_MANAGER, and only their own account for a STANDARD user. This is what makes a populated table on /admin/users acceptable rather than a leak.

POST /v1/groups is deliberately absent from that table: a group manager is wrongly allowed it (#1468), and asserting the current behaviour would lock the defect in.

Supporting changes

• data-testid attributes in apps/web for the elements the new specs select.
• authenticateWithToken fixture, so a spec can act as a specific seeded user rather than a worker-cached role; authenticateAs now delegates to it, which removes a hand-rolled addInitScript block from group-manage.
• ApiClient.findGroupById, used to check whether a refused write actually took effect.
• testing/AGENTS.md fixture table updated.

Two defects fixed inline

Both blocked writing the tests at all, so they were fixed here rather than filed:

• DisclaimerProvider used data-test-id (hyphenated) on all four of its selectors, so the disclaimer dialog was unreachable by Playwright's default testid convention.
• UserDropup's trigger called setIsOpen(!isOpen) in an onClick on top of Radix's own controlled open/onOpenChange handling on the same DropdownMenu.Trigger. Both fire on one real click, and the second — driven by stale isOpen — intermittently flipped the menu straight back shut, so a normal click on the sidebar user menu sometimes silently did nothing.

Everything else found along the way

Filed rather than asserted, so no broken behaviour is pinned as correct: #1468, #1469, #1470, #1471, #1472, #1473, #1474, #1475, #1476, and DouglasNeuroInformatics/libui#108.

Test plan

• pnpm lint — passes repo-wide (33/33).
• pnpm test:e2e — runs in CI on this PR. It was not run locally: a dev stack was holding the API port, and Playwright's own servers cannot start alongside it (running against the dev stack is not an option, since global/teardown.spec.ts drops the database).

🤖 Generated with Claude Code