test(ui): Playwright RLS sweep — real-browser proof, both personas

Phase 5.5 (plan §7.5) first increment: the SSR/HTMX frontend is swept
in a real browser (official Playwright image, no host browsers) for
BOTH personas — testuser (admin) and rls-phone (restricted; Audiobooks
hidden from them via the visibility API).

Green checks: auth rejection + session establishment; admin dashboard
renders sections incl. the hidden-from-others library; restricted
dashboard renders real sections (Recently Added present — not a
vacuous landing-page pass) with ZERO hidden-library traces; search and
media payloads leak nothing for the restricted persona.

Harness lessons encoded: / is a landing page (dashboard lives at
/dashboard); the login endpoint rate-limits rapid attempts so sessions
are established once per persona and reused via storageState — a sweep
must not look like a brute-force run; getByText visibility assertions
are wrong for <option> text (library switcher) — body-textContent
assertions instead.

COVERAGE.md tracks the full 14-area sweep per the plan; the remaining
areas (reader, collections CRUD, admin matrix, upload roundtrip) are
enumerated and pending their sweep runs.

tests/ui/COVERAGE.md

@@ -0,0 +1,24 @@
+# UI sweep coverage (plan §7.5)
+
+Gate: every line below executes for BOTH personas unless marked
+"admin-only". Status: ✅ swept+green · 🔲 pending (future sweep runs).
+
+| # | Page / control | admin | restricted |
+|---|---|---|---|
+| 1 | Login: bad password rejected; good login lands authed; logout | ✅ | ✅ |
+| 2 | Dashboard: sections render (Recently Added / Not Started) | ✅ | ✅ (hidden lib absent) |
+| 3 | Dashboard: hidden library visibility (Audiobooks) | ✅ visible | ✅ absent |
+| 4 | Search: results scoped (`/api/media-items/search`) | ✅ | ✅ no leaks |
+| 5 | Media list: no hidden items in payloads | ✅ | ✅ |
+| 6 | Library browse grid + pagination | 🔲 | 🔲 |
+| 7 | Library create / edit / delete (admin) | 🔲 | n/a |
+| 8 | Admin visibility toggle roundtrip (hide → restricted loses → unhide) | 🔲 | 🔲 |
+| 9 | Media detail: edit metadata / archive / delete | 🔲 | n/a |
+| 10 | Reader: open, page turn, TOC, bookmark, highlight, note, settings | 🔲 | 🔲 |
+| 11 | Collections: CRUD, add/remove items, smart-rule editor | 🔲 | 🔲 |
+| 12 | Series: list/detail | 🔲 | 🔲 |
+| 13 | Stats screens + range filters | 🔲 | 🔲 |
+| 14 | Admin: users CRUD, visibility matrix, settings toggles, processing issues | 🔲 | n/a |
+| 15 | Upload: EPUB generated at runtime, upload → appears → delete | 🔲 | n/a |
+| 16 | Auth edges: restricted → admin URL; anonymous → media URL | 🔲 | ✅ (detail/404) |
+| 17 | OPDS / KOReader | API-covered (invariant test) | API-covered |