Admin: Add focused Playwright security and role-boundary end-to-end tests

[gekichumai-admin]

Phase / step: Phase 5 — Security and quality / Step 4
Parent: #301
Depends on: #338, #321, #322, #326, #327, #341, #339

Context and goal

The highest-risk failures cross frontend, session, API, and database boundaries. A focused Playwright suite should prove that direct navigation and crafted UI flows cannot cross role boundaries, while keeping fixtures deterministic and suitable for CI.

Scope and implementation notes

• Add a Playwright harness that starts the built admin SPA and an isolated test backend/database with deterministic seed/reset helpers. Use test-only authentication setup that cannot be enabled in non-test environments.
• Create ordinary-user, administrator, super-administrator, banned-user, promoted-but-not-relogged, and recently-authenticated/not-recently-authenticated fixtures.
• Test direct URL navigation and data loading for unauthenticated and ordinary users, not only hidden navigation controls.
• Cover role hierarchy: administrator cannot manage administrators or moderate privileged targets; super-administrator can grant/revoke administrators and moderate administrators; no tested flow can alter or ban a super-administrator.
• Verify destructive-action step-up expiry and renewal, comment delete/tombstone/restore, temporary/permanent ban and session revocation, role promotion fresh-login requirement, and role revocation.
• Cover chart-report submission/review boundaries, including Turnstile's documented test mode, ordinary-user inability to access review routes, and close conflict handling.
• Include one provenance/raw-artifact authorization test proving an ordinary session or direct URL cannot retrieve admin evidence/downloads.
• Run the focused suite in a desktop Chromium project and a representative tablet viewport. Retain traces/screenshots only on failure and scrub them of credentials and realistic personal data.

Acceptance criteria

• The suite runs reproducibly from a clean CI environment with isolated database state.
• Test-only authentication/Turnstile bypasses are impossible to enable in preview or production builds.
• 401/403 behavior is verified by direct navigation and network responses for ordinary users.
• The complete administrator/super-administrator moderation and role hierarchy matrix is covered.
• Step-up expiry, password/OAuth-compatible renewal contract, promotion relogin, and revocation behavior are exercised.
• Comment deletion/restoration and temporary/permanent ban effects are verified end to end.
• Public report submission and private review/close authorization boundaries are tested.
• Raw-artifact viewing/downloading is inaccessible outside an authorized admin session.
• Failure artifacts are useful for diagnosis but contain no credentials or realistic sensitive user/moderation data.

Out of scope

• Exhaustive browser/device combinations.
• Pixel-perfect visual regression testing.
• Performance/load testing.
• Testing the external identity-aware access provider itself.