feat(#454, #430): an is_admin E2E fixture, and the two AAA violations it found - #509

… it found

No E2E run had ever rendered an admin page. `AdminGate.tsx:81` bounces an
authenticated non-admin to `/`, so three separate things were measuring the
wrong page or nothing: the AAA sweep reported six `/admin*` routes as swept
while measuring the HOME page, the admin table wells could not be verified
(draft PR #503 sat 17/17 green and unmergeable), and the landmark gate had to
exclude those six outright.

`seedIsolatedAdmin()` promotes a throwaway user through
`user_profiles.is_admin` — the single authority since #240, read live by the
`is_admin()` SECURITY DEFINER RPC. One service-role UPDATE; no token refresh
and no auth-hook registration, because no live RLS policy reads the JWT claim.

It VERIFIES ITSELF through the user's own session and throws otherwise. A
silently-unpromoted user still renders — it renders the redirect — so every
assertion downstream would measure the home page and pass. That is the defect
#454 is about, and without the check the fixture built to fix it would
reproduce it.

Not the shared storage-state user, deliberately: `is_admin()` gates 25 policies
across 9 tables, so promoting it would give every existing spec cross-user
reads and row-count assertions would keep passing while measuring something
else.

Unblinding the sweep immediately found two real AAA violations on
/admin/email, both invisible until now:

  .stat-title           #484f58 on #ebe5dd  6.62:1   (3 elements)
  text-base-content/70  #5f656d on #f5f0eb  5.19:1   (2 elements)

The first is the sharper one. globals.css ALREADY corrected `.stat-title`,
raising alpha to 80% and documenting "~7.1:1 on light". Measured: 6.62. 7.1 was
computed against base-100; a `.stats` block sits on base-200 — exactly the trap
#462 records, where /80 measures 7.08 on base-100 and 6.4-6.5 on base-200. The
alpha was right for the surface it was checked on and wrong for the one it
renders on. Now solid, like #411, #425 and #495 before it.

Coverage: landmark sweep 36 -> 42 paths (exclusions 9 -> 3); contrast sweep
36 -> 42 paths x 2 themes, 85 passing.

Mutation-tested against the original defect: with the sh-well wrapper reverted,
admin-depth reports `0/1 scrollers welled` and fails by name. The spec asserts
the INVARIANT (every scroller is welled) rather than the element, because
/admin/messaging's well is behind `top_senders.length > 0` — a data-dependent
element is how #495 looked like a flake. A floor stops it passing vacuously.

Orphan sweep in auth.setup.ts pages through listUsers (#197 truncates at 50)
and deletes throwaway admins that survived a previous run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…d not see it

CI found both defects on the first run that could reach an admin page as an
admin — which is the entire argument for #454's fixture.

1. #430's fix wrapped the two HAND-ROLLED scrollers in AdminPaymentPanel and
   AdminMessagingOverview and missed `AdminDataTable`, the shared component
   several admin surfaces render. It only appears when there is data, so a
   local project with no conversations never rendered it. CI's shared project
   has data, and the spec reported it by name:

     /admin/messaging: 1 scroller(s) are not wrapped in .sh-well
     unwelled parent: "flex flex-col gap-3 mt-8"

   Wrapping it in AdminDataTable fixes every consumer at once.

2. The spec itself was timing-dependent, and that is why CI called it FLAKY
   rather than failed. `page.evaluate` does not retry the way a web-first
   assertion does (#396, instance 5) — it snapshots the DOM once. The admin
   panels render a `loading-spinner` until their RPCs return, so counting too
   early sees zero scrollers and passes on nothing. Measured: a 3.5s settle
   read 0/0 on /admin/payments, which had read 1/1 moments earlier.

   It now waits for `.loading-spinner` to reach count 0 — a signal, not a
   sleep — and re-reads through `expect.poll`. /admin/messaging goes from 0/0
   to 1/1 locally as a result: the scroller was always there, the spec just
   measured before it existed.

The flake was the tell. A test that passes when the data is absent and fails
when it is present is not flaky; it is a defect plus a vacuous pass, which is
the shape #495 wore.

No mutation test needed for the AdminDataTable fix: CI already ran it against
the original defect and failed by name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>