fix(e2e): add Playwright auth fixture to unblock 356 UI tests

[mborgeson]

Root cause

The 356/403 E2E failures on PR #8 trace to a single defect: every browser-context test in e2e/ calls page.goto(...) on a protected route without an authenticated browser session. RequireAuth (defined in src/app/router.tsx) sees isAuthenticated === false, returns <Navigate to=\"/login\" replace />, and the assertion expect(page.locator('main')).toBeVisible() times out because <main> only renders inside AppLayout — which lives under RequireAuth.

The 47 passing tests are all API-only — they use Playwright's request fixture and never spin up a browser, so the auth gate is irrelevant.

Fix

Implement Playwright storageState global setup so all browser-context tests start authenticated.

• e2e/global.setup.ts (new): a Playwright "setup" test that drives the UI login form with TEST_CREDENTIALS.admin and persists cookies + localStorage (where authStore.ts writes the JWT) to e2e/.auth/admin.json via context.storageState({ path }).
• playwright.config.ts: adds a setup project keyed off global.setup.ts, and wires both chromium and ci projects to dependencies: ['setup'] plus use.storageState: 'e2e/.auth/admin.json'.
• e2e/auth.spec.ts — "Protected Routes (Frontend)" describe block: when written, the app had no auth gate and these tests asserted that <main> renders without auth. They now use test.use({ storageState: { cookies: [], origins: [] } }) to opt out of the global storage state and assert that RequireAuth redirects to /login.
• .gitignore: adds e2e/.auth/ so the storage file (which contains a real JWT) never gets committed.

Expected impact

Roughly 340 of the 356 currently-failing browser tests should flip to passing once the setup project runs successfully and the storage state seeds an authenticated session into each browser context. The remaining ~16 failures are likely unrelated (selector drift, fixture data, timing) and can be triaged on the next CI run.

Type sanity check: npx tsc --noEmit playwright.config.ts e2e/global.setup.ts e2e/auth.spec.ts exits 0. The full E2E suite was not run locally — CI will validate.

Branch hygiene

Branched from origin/main. Does not touch ci/fix-e2e-seed-and-bcrypt (PR #8) or feat/test-quality-system (PR #11).

Follow-ups (not in this PR)

These are the "right fix" items the architect flagged for a separate change:

• Workflow seed-gate — make the E2E job fail fast if seed users are missing instead of letting tests time out.
• Smoke fail-fast — run a tiny smoke check before the full suite so credentials/seed/auth-gate breakage surfaces in seconds, not minutes.
• Per-role storage states — extend the setup project to produce analyst.json (and any future roles) so role-gated tests can opt in without UI logging in each time.

Test plan

• CI green on chromium project (storage state authenticates correctly, ~340 tests flip from fail to pass)
• Protected Routes (Frontend) describe still verifies redirect-to-login behavior (now via empty storageState override)
• No regression in the 47 API-only tests that already passed
• e2e/.auth/admin.json is not committed (verify via git ls-files e2e/.auth/)

Generated with Claude Code