Add E2E coverage for login + bulk import wizards

[studert]

Problem

The Playwright E2E suite under tests/e2e/ has only two specs and does not cover the auth flow or the bulk-import wizards, even though those are among the most user-facing and easiest-to-break flows in the app. We are one CSS regression or routing change away from a silent broken-login deploy.

Evidence

• tests/e2e/ contains 2 specs at audit time (budget calculations, sync dashboard).
• src/app/(auth)/login/* — Credentials login + mustChangePassword first-login redirect.
• src/app/users/import/* and src/app/assignments/import/* (or the equivalent bulk paths from spec 004 / spec 011) — multi-step wizards with file upload + preview + commit.

Proposed approach

Add three Playwright specs:

tests/e2e/auth-login.spec.ts

1. Navigate to /login.
2. Submit invalid credentials → expect inline error and no nav.
3. Submit valid credentials (use a seeded test user) → expect redirect to /.
4. Submit valid credentials for a mustChangePassword user → expect redirect to /setup-password and successful change.
5. After login, log out (if there is a logout UI) → expect redirect to /login.

tests/e2e/users-bulk-import.spec.ts

1. Login as admin.
2. Navigate to the bulk-import wizard.
3. Upload a small fixture CSV with 5 valid rows.
4. Verify the preview renders the parsed rows.
5. Confirm the import → expect a success toast and the new users visible in /users.
6. Re-upload the same CSV → expect duplicate handling per the spec.

tests/e2e/licenses-bulk-assign.spec.ts

1. Login as admin.
2. Navigate to the bulk license-assignment wizard.
3. Upload a fixture CSV that assigns N users to a tool that has capacity.
4. Confirm → expect success and the assignments visible in /assignments.
5. Try the same flow with capacity exceeded → expect the documented error.

Fixtures + harness

• Add tests/e2e/fixtures/ with the CSVs.
• Reuse the seeding util used by other E2E specs, or create one if missing — needs to upsert a deterministic admin and at least one tool with a known capacity.
• Stub Resend so invite emails aren't sent (set RESEND_API_KEY=test and short-circuit the email helper, or use Playwright route mocks).

Acceptance criteria

• Three new E2E specs land under tests/e2e/.
• Each spec passes locally via pnpm test:e2e.
• Specs are deterministic — they reset DB state in beforeEach (or use fresh test branches).
• No real emails are sent.
• pnpm lint && pnpm typecheck pass.

Verification

1. pnpm test:e2e tests/e2e/auth-login.spec.ts is green.
2. pnpm test:e2e tests/e2e/users-bulk-import.spec.ts is green.
3. pnpm test:e2e tests/e2e/licenses-bulk-assign.spec.ts is green.
4. Break the credentials check in lib/auth.ts (e.g. always reject) → login spec fails. Revert.