Testing: WebAuthn/passkey ceremony, select-authenticator, RTL, zoom, forced-colors, and CSP coverage #107

Parent

Follow-up to #102 (closed) and part of #91.

Context

#102 added a real Playwright suite against a live disposable Keycloak instance (pinned to keycloak.lock's exact image+digest), covering shell geometry, a WCAG scan, staged identity/credential interaction, the theme toggle, JS-disabled fallback, and TOTP setup across all six historical viewport tiers -- wired into CI (#105, merged). It already caught and fixed two real bugs no static review had (a light-mode contrast break from an upstream !important override, and a Google Fonts CDN/privacy leak in the vendored xore-theme.css). Closed with real remaining gaps documented rather than claimed done. This issue tracks finishing them.

Scope

• WebAuthn/passkey ceremony testing (#authenticateWebAuthnButton / #registerWebAuthn real ceremony flow) -- Playwright supports mocking WebAuthn via CDP's virtual authenticator API; not yet wired up. Depends on Theme: finish auditing/styling remaining login pages (WebAuthn, select-authenticator, verify-email, consent/device-code) #106's WebAuthn page audit landing first for the styling to test against.
• select-authenticator.ftl interaction/visual coverage, once Theme: finish auditing/styling remaining login pages (WebAuthn, select-authenticator, verify-email, consent/device-code) #106 lands a design for it.
• Consent (login-oauth-grant.ftl) and device-code (login-oauth2-device-verify-user-code.ftl) flow coverage, once Theme: finish auditing/styling remaining login pages (WebAuthn, select-authenticator, verify-email, consent/device-code) #106 confirms which are actually reachable via real client configs.
• RTL smoke checks (realm.internationalizationEnabled / dir="rtl" per base/login/template.ftl).
• 200% zoom/reflow checks.
• forced-colors media query smoke checks.
• Simulated reduced-motion interaction -- the static prefers-reduced-motion CSS rule exists and is asserted structurally, but motion is not actually simulated/verified in the browser.
• CSP violation assertions (currently only console-error and external-request assertions exist, not CSP-specific).

Reference

Suite lives in test/ in auth-backend (test/specs/login.spec.ts, test/docker-compose.test.yml, test/fixtures/realm-export.json). Local run instructions in docs/THEME-GUIDE.md's "Regression suite (#102)" section.