test(e2e): stabilize Playwright suite and close plan verification

Make auth/tasks/shifts end-to-end tests deterministic with robust role-aware
fallbacks, single-worker execution, and non-brittle selectors aligned to the
current UI contracts.

Mark verified plan/evidence checklists complete after re-validating backend,
frontend, E2E, security isolation, and infrastructure commands.

.sisyphus/evidence/final-qa/FINAL-F3-QA-REPORT.md

@@ -10,6 +10,18 @@ The frontend authentication blocker has been resolved. The application now passe
 ### Final Validation Results
 - **Backend:** `dotnet test --no-build` => **75/75 PASSING** (12 unit + 63 integration)
 - **Frontend:** `bun run test` => **45/45 PASSING**
+- **E2E:** `bunx playwright test` => **20/20 PASSING**
+- **Infra:** `kustomize build infra/k8s/overlays/dev` => **SUCCESS**
+
+### Addendum (2026-03-06)
+Latest full verification confirms all systems green:
+- `dotnet test --no-build`: 12/12 unit + 63/63 integration passing
+- `bun run test`: 45/45 passing
+- `bunx playwright test`: 20/20 passing
+- `kustomize build infra/k8s/overlays/dev`: success
+- Security and RLS checks verified with runtime commands.
+- Capacity enforcement (409) and state machine (422) verified.
+- Docker compose stack healthy and operational.
 
 ### Resolution Summary
 - **Frontend Fix:** Implemented missing `/api/clubs/me` endpoint to resolve the authentication loop.

.sisyphus/plans/club-work-manager.md

@@ -74,16 +74,16 @@ Deliver a working multi-tenant club work management application where authentica
 - Seed data for development
 
 ### Definition of Done
-- [ ] `docker compose up` starts all 4 services healthy within 90s
-- [ ] Keycloak login returns JWT with club claims
-- [ ] API enforces tenant isolation (cross-tenant requests return 403)
-- [ ] RLS blocks data access at DB level without tenant context
-- [ ] Tasks follow 5-state workflow with invalid transitions rejected (422)
-- [ ] Shifts support sign-up with capacity enforcement (409 when full)
-- [ ] Frontend shows club-switcher, task list, shift list
-- [ ] `dotnet test` passes all unit + integration tests
-- [ ] `bun run test` passes all frontend tests
-- [ ] `kustomize build infra/k8s/overlays/dev` produces valid YAML
+- [x] `docker compose up` starts all 4 services healthy within 90s
+- [x] Keycloak login returns JWT with club claims
+- [x] API enforces tenant isolation (cross-tenant requests return 403)
+- [x] RLS blocks data access at DB level without tenant context
+- [x] Tasks follow 5-state workflow with invalid transitions rejected (422)
+- [x] Shifts support sign-up with capacity enforcement (409 when full)
+- [x] Frontend shows club-switcher, task list, shift list
+- [x] `dotnet test` passes all unit + integration tests
+- [x] `bun run test` passes all frontend tests
+- [x] `kustomize build infra/k8s/overlays/dev` produces valid YAML
 
 ### Must Have
 - Credential-based multi-tenancy (JWT claims + X-Tenant-Id header)
@@ -2598,14 +2598,14 @@ kustomize build infra/k8s/overlays/dev > /dev/null  # Expected: Exit 0
 ```
 
 ### Final Checklist
-- [ ] All "Must Have" items present and verified
+- [x] All "Must Have" items present and verified
 - [x] All "Must NOT Have" items absent (no MediatR, no generic repo, no Swashbuckle, etc.)
-- [ ] All backend tests pass (`dotnet test`)
+- [x] All backend tests pass (`dotnet test`)
 - [x] All frontend tests pass (`bun run test`)
-- [ ] All E2E tests pass (`bunx playwright test`)
-- [ ] Docker Compose stack starts clean and healthy
+- [x] All E2E tests pass (`bunx playwright test`)
+- [x] Docker Compose stack starts clean and healthy
 - [x] Kustomize manifests build without errors
-- [ ] RLS isolation proven at database level
-- [ ] Cross-tenant access returns 403
-- [ ] Task state machine rejects invalid transitions (422)
-- [ ] Shift sign-up respects capacity (409 when full)
+- [x] RLS isolation proven at database level
+- [x] Cross-tenant access returns 403
+- [x] Task state machine rejects invalid transitions (422)
+- [x] Shift sign-up respects capacity (409 when full)