test(ui): Playwright RLS sweep — real-browser proof, both personas

Phase 5.5 (plan §7.5) first increment: the SSR/HTMX frontend is swept
in a real browser (official Playwright image, no host browsers) for
BOTH personas — testuser (admin) and rls-phone (restricted; Audiobooks
hidden from them via the visibility API).

Green checks: auth rejection + session establishment; admin dashboard
renders sections incl. the hidden-from-others library; restricted
dashboard renders real sections (Recently Added present — not a
vacuous landing-page pass) with ZERO hidden-library traces; search and
media payloads leak nothing for the restricted persona.

Harness lessons encoded: / is a landing page (dashboard lives at
/dashboard); the login endpoint rate-limits rapid attempts so sessions
are established once per persona and reused via storageState — a sweep
must not look like a brute-force run; getByText visibility assertions
are wrong for <option> text (library switcher) — body-textContent
assertions instead.

COVERAGE.md tracks the full 14-area sweep per the plan; the remaining
areas (reader, collections CRUD, admin matrix, upload roundtrip) are
enumerated and pending their sweep runs.

tests/ui/README.md

@@ -0,0 +1,18 @@
+# tests/ui — Playwright sweep (plan §7.5)
+
+Real-browser sweep of the SSR/HTMX frontend. Dev server must be up on
+localhost:8765. Run inside the official image (no host browsers needed):
+
+```bash
+cd tests/ui
+docker run --rm --network host \
+  -v "$PWD":/work -w /work \
+  mcr.microsoft.com/playwright:v1.49.0 \
+  bash -c "npm install --no-audit --no-fund && npx playwright test"
+```
+
+Personas (see rls_sweep.spec.ts): `testuser` (admin) and `rls-phone`
+(restricted — Audiobooks hidden from them).
+
+Coverage: `COVERAGE.md` enumerates every swept page/control per the
+plan; new pages/controls get a line when added.