Wire authentication into the application

Adds the sign-in screen, sign-out, and a server-side guard on every
application route. The guard lives in the layout rather than the proxy
because the proxy cannot query the database to check whether a session
was revoked — and revocation is the reason sessions are stored there.

Sign-in returns one message for an unknown account and for a wrong
password, and verifies a dummy hash when the account does not exist, so
neither the wording nor the timing enumerates staff addresses. An
end-to-end test compares the two messages rather than trusting the
code to keep them aligned.

The shell now shows the signed-in person and their role from the
database instead of hardcoded initials.

Playwright signs in once in a setup project and shares the cookie;
argon2 is deliberately slow, and logging in per test would also drive
the shared failed-attempt counter toward a lockout. The seed resets
that counter so repeated local runs cannot lock the demo account.

Two test locators had to be scoped to the form: Next's route announcer
carries role="alert" and an empty string, which silently satisfied the
assertion.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv

playwright.config.ts

@@ -1,5 +1,17 @@
 import { defineConfig, devices } from '@playwright/test';
 
+import { STORAGE_STATE } from './tests/e2e/storage';
+
+/**
+ * Certains environnements fournissent déjà un Chromium dont la révision ne
+ * correspond pas à celle qu'attend cette version de Playwright.
+ * PLAYWRIGHT_CHROMIUM_PATH permet de le réutiliser plutôt que d'en télécharger
+ * un second.
+ */
+const chromiumOverride = process.env.PLAYWRIGHT_CHROMIUM_PATH
+  ? { launchOptions: { executablePath: process.env.PLAYWRIGHT_CHROMIUM_PATH } }
+  : {};
+
 const PORT = Number(process.env.E2E_PORT ?? 3100);
 const baseURL = `http://127.0.0.1:${PORT}`;
 
@@ -18,21 +30,27 @@ export default defineConfig({
   },
 
   projects: [
+    // Ouvre une session et enregistre le cookie ; les autres projets
+    // le réutilisent.
+    {
+      name: 'setup',
+      testMatch: /auth\.setup\.ts/,
+      use: { ...devices['Desktop Chrome'], ...chromiumOverride },
+    },
+    // Parcours d'authentification : doit partir d'un navigateur vierge.
+    {
+      name: 'anonyme',
+      testMatch: /auth\.spec\.ts/,
+      use: { ...devices['Desktop Chrome'], ...chromiumOverride },
+    },
     {
       name: 'chromium',
+      testIgnore: /auth\.(setup|spec)\.ts/,
+      dependencies: ['setup'],
       use: {
         ...devices['Desktop Chrome'],
-        // Certains environnements fournissent déjà un Chromium dont la révision
-        // ne correspond pas à celle qu'attend cette version de Playwright.
-        // PLAYWRIGHT_CHROMIUM_PATH permet de le réutiliser plutôt que d'en
-        // télécharger un second.
-        ...(process.env.PLAYWRIGHT_CHROMIUM_PATH
-          ? {
-              launchOptions: {
-                executablePath: process.env.PLAYWRIGHT_CHROMIUM_PATH,
-              },
-            }
-          : {}),
+        ...chromiumOverride,
+        storageState: STORAGE_STATE,
       },
     },
   ],