test: massive test coverage expansion (+1,437 tests, 22 new files)

Expand test coverage across all layers via 14 parallel agents:

Unit tests (3,378 total, +534):
- First-ever AI sidecar tests (157 tests covering bridge lifecycle, all 12 tool modules)
- API route infrastructure (auth, pipeline, batch, settings, teams, roles, audit, api-keys, files, docs)
- Lib coverage improvements (audit 7%->95%, worker-pool 33%->100%)
- Web store/lib gap fills (features-store, tool-registry)

Integration tests (4,403 total, +903):
- Expanded 19 tool test files with parameter variations, format edge cases, boundary values
- Cross-format matrix: 290 tests covering 14 tools x 17 formats
- Adversarial/edge cases: 63 tests for extreme inputs, concurrent requests, corrupted files

E2E-Docker (125 new tests):
- Expanded 8 spec files + 1 new file covering all 49 tools
- Added HEIC/format handling, auth failures, download verification

GUI E2E (expanded 28 spec files):
- Navigation, responsive layout, keyboard shortcuts
- All 51 tool UIs with settings, processing, display modes
- Batch/pipeline workflows, settings/RBAC, visual regression
- Resilience, accessibility (ARIA, contrast, focus), performance budgets

tests/e2e/gui-settings-people.spec.ts

@@ -280,6 +280,97 @@ test.describe("GUI Settings - People Tab", () => {
     await page.getByRole("button", { name: /cancel/i }).click();
     await expect(page.getByText(/reset password for/i)).not.toBeVisible();
   });
+
+  test("editing a user role via Edit Role / Team succeeds", async ({ loggedInPage: page }) => {
+    const username = `guiedit-${UID}`;
+    const adminToken = await getAdminToken();
+
+    try {
+      // Create a user via API first
+      await fetch(`${API}/api/auth/register`, {
+        method: "POST",
+        headers: authJson(adminToken),
+        body: JSON.stringify({ username, password: "TestPass123!", role: "user" }),
+      });
+
+      await openSettings(page);
+      await page.getByRole("button", { name: /people/i }).click();
+      await page.waitForTimeout(500);
+
+      // Verify the user appears
+      await expect(page.getByText(username)).toBeVisible({ timeout: 5_000 });
+
+      // Open the actions menu for the test user (last Actions button)
+      await page.getByTitle("Actions").last().click();
+      await page.getByText("Edit Role / Team").click();
+
+      // The edit form should appear
+      await expect(page.getByText(/edit/i).first()).toBeVisible();
+
+      // Change role to editor
+      const roleSelect = page.locator("form select").first();
+      await roleSelect.selectOption("editor");
+
+      // Click Save
+      await page.getByRole("button", { name: /^save$/i }).click();
+
+      // Wait for the update to complete and verify no error
+      await page.waitForTimeout(1_000);
+
+      // The user row should still be visible (edit was successful)
+      await expect(page.getByText(username)).toBeVisible();
+    } finally {
+      await cleanupUsersByPrefix(adminToken, "guiedit-");
+    }
+  });
+
+  test("resetting password for a non-admin user succeeds", async ({ loggedInPage: page }) => {
+    const username = `guireset-${UID}`;
+    const adminToken = await getAdminToken();
+
+    try {
+      // Create a user via API
+      await fetch(`${API}/api/auth/register`, {
+        method: "POST",
+        headers: authJson(adminToken),
+        body: JSON.stringify({ username, password: "TestPass123!", role: "user" }),
+      });
+
+      await openSettings(page);
+      await page.getByRole("button", { name: /people/i }).click();
+      await page.waitForTimeout(500);
+
+      // Verify the user appears
+      await expect(page.getByText(username)).toBeVisible({ timeout: 5_000 });
+
+      // Open the actions menu for the test user (last Actions button)
+      await page.getByTitle("Actions").last().click();
+      await page.getByText("Reset Password").click();
+
+      // Fill in the new password
+      await expect(page.getByText(/reset password for/i)).toBeVisible();
+      await page.getByPlaceholder(/new password/i).fill("NewResetPass123!");
+
+      // Submit
+      await page.getByRole("button", { name: /reset password/i }).click();
+
+      // Should show success or dismiss the form
+      await page.waitForTimeout(1_000);
+      // The reset form should close on success
+      await expect(page.getByText(/reset password for/i)).not.toBeVisible({ timeout: 5_000 });
+    } finally {
+      await cleanupUsersByPrefix(adminToken, "guireset-");
+    }
+  });
+
+  test("user table shows role in uppercase badge format", async ({ loggedInPage: page }) => {
+    await openSettings(page);
+    await page.getByRole("button", { name: /people/i }).click();
+    await page.waitForTimeout(500);
+
+    // Admin user should show ADMIN role badge
+    await expect(page.getByText("ADMIN").first()).toBeVisible();
+  });
 });
 
 test.describe("GUI Settings - Teams Tab", () => {