test: massive test coverage expansion (+1,437 tests, 22 new files)

Expand test coverage across all layers via 14 parallel agents:

Unit tests (3,378 total, +534):
- First-ever AI sidecar tests (157 tests covering bridge lifecycle, all 12 tool modules)
- API route infrastructure (auth, pipeline, batch, settings, teams, roles, audit, api-keys, files, docs)
- Lib coverage improvements (audit 7%->95%, worker-pool 33%->100%)
- Web store/lib gap fills (features-store, tool-registry)

Integration tests (4,403 total, +903):
- Expanded 19 tool test files with parameter variations, format edge cases, boundary values
- Cross-format matrix: 290 tests covering 14 tools x 17 formats
- Adversarial/edge cases: 63 tests for extreme inputs, concurrent requests, corrupted files

E2E-Docker (125 new tests):
- Expanded 8 spec files + 1 new file covering all 49 tools
- Added HEIC/format handling, auth failures, download verification

GUI E2E (expanded 28 spec files):
- Navigation, responsive layout, keyboard shortcuts
- All 51 tool UIs with settings, processing, display modes
- Batch/pipeline workflows, settings/RBAC, visual regression
- Resilience, accessibility (ARIA, contrast, focus), performance budgets

tests/e2e/gui-settings-rbac.spec.ts

@@ -165,6 +165,68 @@ base.describe("RBAC Settings Visibility - Admin", () => {
     const count = await navButtons.count();
     expect(count).toBe(12);
   });
+
+  base.test("admin can navigate to System Settings and see configuration", async ({ page }) => {
+    await page.goto("/");
+    await openSettings(page);
+    await page.getByRole("button", { name: /system settings/i }).click();
+
+    await expect(page.locator("h3").filter({ hasText: "System Settings" })).toBeVisible();
+    await expect(page.getByText("File Upload Limit (MB)")).toBeVisible();
+    await expect(page.getByText("Default Theme")).toBeVisible();
+  });
+
+  base.test("admin can navigate to Teams tab and see team list", async ({ page }) => {
+    await page.goto("/");
+    await openSettings(page);
+    await page.getByRole("button", { name: /teams/i }).click();
+
+    await expect(page.locator("h3").filter({ hasText: "Teams" })).toBeVisible();
+    await expect(page.getByText("Default").first()).toBeVisible();
+  });
+
+  base.test("admin can navigate to Roles tab and see built-in roles", async ({ page }) => {
+    await page.goto("/");
+    await openSettings(page);
+    await page.getByRole("button", { name: /^roles$/i }).click();
+
+    await expect(page.locator("h3").filter({ hasText: "Roles" })).toBeVisible();
+    await expect(page.getByText("Built-in").first()).toBeVisible();
+  });
+
+  base.test("admin can navigate to AI Features tab", async ({ page }) => {
+    await page.goto("/");
+    await openSettings(page);
+    await page.getByRole("button", { name: /ai features/i }).click();
+
+    await expect(page.locator("h3").filter({ hasText: "AI Features" })).toBeVisible();
+  });
+
+  base.test("admin has full API access to admin endpoints", async ({ page }) => {
+    await page.goto("/");
+
+    const token = await page.evaluate(() => localStorage.getItem("snapotter-token"));
+    expect(token).toBeTruthy();
+    const bearerToken = token as string;
+
+    // GET /api/auth/users requires users:manage
+    const usersRes = await fetch(`${API}/api/auth/users`, {
+      headers: { Authorization: `Bearer ${bearerToken}` },
+    });
+    expect(usersRes.status).toBe(200);
+
+    // GET /api/v1/settings requires settings:read
+    const settingsRes = await fetch(`${API}/api/v1/settings`, {
+      headers: { Authorization: `Bearer ${bearerToken}` },
+    });
+    expect(settingsRes.status).toBe(200);
+
+    // GET /api/v1/audit-log requires audit:read
+    const auditRes = await fetch(`${API}/api/v1/audit-log`, {
+      headers: { Authorization: `Bearer ${bearerToken}` },
+    });
+    expect(auditRes.status).toBe(200);
+  });
 });
 
 base.describe("RBAC Settings Visibility - Editor", () => {
@@ -240,6 +302,46 @@ base.describe("RBAC Settings Visibility - Editor", () => {
 
     await expect(page.getByRole("button", { name: /generate api key/i })).toBeVisible();
   });
+
+  base.test("editor can access Tools tab and see tool toggles", async ({ page }) => {
+    await login(page, EDITOR_USER, EDITOR_PASS);
+    await openSettings(page);
+    await page.getByRole("button", { name: /tools/i }).click();
+
+    await expect(page.locator("h3").filter({ hasText: "Tools" }).first()).toBeVisible();
+    await expect(page.getByText(/\d+ tools? disabled/)).toBeVisible({ timeout: 5_000 });
+  });
+
+  base.test("editor gets 403 on admin API endpoints", async ({ page }) => {
+    await login(page, EDITOR_USER, EDITOR_PASS);
+
+    const token = await page.evaluate(() => localStorage.getItem("snapotter-token"));
+    expect(token).toBeTruthy();
+    const bearerToken = token as string;
+
+    // GET /api/auth/users requires users:manage -- editor does not have this
+    const usersRes = await fetch(`${API}/api/auth/users`, {
+      headers: { Authorization: `Bearer ${bearerToken}` },
+    });
+    expect(usersRes.status).toBe(403);
+
+    // PUT /api/v1/settings requires settings:write -- editor does not have this
+    const settingsRes = await fetch(`${API}/api/v1/settings`, {
+      method: "PUT",
+      headers: {
+        Authorization: `Bearer ${bearerToken}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ testSetting: "hacked" }),
+    });
+    expect(settingsRes.status).toBe(403);
+
+    // GET /api/v1/audit-log requires audit:read -- editor does not have this
+    const auditRes = await fetch(`${API}/api/v1/audit-log`, {
+      headers: { Authorization: `Bearer ${bearerToken}` },
+    });
+    expect(auditRes.status).toBe(403);
+  });
 });
 
 base.describe("RBAC Settings Visibility - User", () => {
@@ -311,4 +413,85 @@ base.describe("RBAC Settings Visibility - User", () => {
     await expect(page.getByText(USER_USER)).toBeVisible({ timeout: 5_000 });
     await expect(page.getByText("user").first()).toBeVisible();
   });
+
+  base.test("user can access Tools tab and see tool toggles", async ({ page }) => {
+    await login(page, USER_USER, USER_PASS);
+    await openSettings(page);
+    await page.getByRole("button", { name: /tools/i }).click();
+
+    await expect(page.locator("h3").filter({ hasText: "Tools" }).first()).toBeVisible();
+    await expect(page.getByText(/\d+ tools? disabled/)).toBeVisible({ timeout: 5_000 });
+  });
+
+  base.test("user can access Security tab and change password form", async ({ page }) => {
+    await login(page, USER_USER, USER_PASS);
+    await openSettings(page);
+    await page.getByRole("button", { name: /security/i }).click();
+
+    await expect(page.getByText("Change Password").first()).toBeVisible();
+    await expect(page.getByPlaceholder("Current Password")).toBeVisible();
+  });
+
+  base.test("user can access Product Analytics tab", async ({ page }) => {
+    await login(page, USER_USER, USER_PASS);
+    await openSettings(page);
+    await page.getByRole("button", { name: /product analytics/i }).click();
+
+    await expect(page.getByText("Product Analytics").first()).toBeVisible();
+  });
+
+  base.test("user gets 403 on admin and editor API endpoints", async ({ page }) => {
+    await login(page, USER_USER, USER_PASS);
+
+    const token = await page.evaluate(() => localStorage.getItem("snapotter-token"));
+    expect(token).toBeTruthy();
+    const bearerToken = token as string;
+
+    // GET /api/auth/users requires users:manage
+    const usersRes = await fetch(`${API}/api/auth/users`, {
+      headers: { Authorization: `Bearer ${bearerToken}` },
+    });
+    expect(usersRes.status).toBe(403);
+
+    // PUT /api/v1/settings requires settings:write
+    const settingsRes = await fetch(`${API}/api/v1/settings`, {
+      method: "PUT",
+      headers: {
+        Authorization: `Bearer ${bearerToken}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ testSetting: "hacked" }),
+    });
+    expect(settingsRes.status).toBe(403);
+
+    // GET /api/v1/audit-log requires audit:read
+    const auditRes = await fetch(`${API}/api/v1/audit-log`, {
+      headers: { Authorization: `Bearer ${bearerToken}` },
+    });
+    expect(auditRes.status).toBe(403);
+
+    // GET /api/v1/teams requires teams:manage
+    const teamsRes = await fetch(`${API}/api/v1/teams`, {
+      headers: { Authorization: `Bearer ${bearerToken}` },
+    });
+    expect(teamsRes.status).toBe(403);
+  });
+
+  base.test("user can still navigate to a tool page and use it", async ({ page }) => {
+    await login(page, USER_USER, USER_PASS);
+
+    // Navigate to the resize tool page -- user role should have tools:use permission
+    await page.goto("/resize");
+    await page.waitForLoadState("networkidle");
+
+    // The tool page should load (not redirect or show a 403)
+    // Look for the dropzone or tool heading
+    const dropzone = page.locator("[class*='border-dashed']");
+    const toolHeading = page.getByText("Resize").first();
+
+    const dropzoneVisible = await dropzone.isVisible().catch(() => false);
+    const headingVisible = await toolHeading.isVisible().catch(() => false);
+
+    expect(dropzoneVisible || headingVisible).toBe(true);
+  });
 });