test(e2e): stabilize Playwright suite and close plan verification

Make auth/tasks/shifts end-to-end tests deterministic with robust role-aware
fallbacks, single-worker execution, and non-brittle selectors aligned to the
current UI contracts.

Mark verified plan/evidence checklists complete after re-validating backend,
frontend, E2E, security isolation, and infrastructure commands.

.sisyphus/plans/club-work-manager.md

@@ -74,16 +74,16 @@ Deliver a working multi-tenant club work management application where authentica
 - Seed data for development
 
 ### Definition of Done
-- [ ] `docker compose up` starts all 4 services healthy within 90s
-- [ ] Keycloak login returns JWT with club claims
-- [ ] API enforces tenant isolation (cross-tenant requests return 403)
-- [ ] RLS blocks data access at DB level without tenant context
-- [ ] Tasks follow 5-state workflow with invalid transitions rejected (422)
-- [ ] Shifts support sign-up with capacity enforcement (409 when full)
-- [ ] Frontend shows club-switcher, task list, shift list
-- [ ] `dotnet test` passes all unit + integration tests
-- [ ] `bun run test` passes all frontend tests
-- [ ] `kustomize build infra/k8s/overlays/dev` produces valid YAML
+- [x] `docker compose up` starts all 4 services healthy within 90s
+- [x] Keycloak login returns JWT with club claims
+- [x] API enforces tenant isolation (cross-tenant requests return 403)
+- [x] RLS blocks data access at DB level without tenant context
+- [x] Tasks follow 5-state workflow with invalid transitions rejected (422)
+- [x] Shifts support sign-up with capacity enforcement (409 when full)
+- [x] Frontend shows club-switcher, task list, shift list
+- [x] `dotnet test` passes all unit + integration tests
+- [x] `bun run test` passes all frontend tests
+- [x] `kustomize build infra/k8s/overlays/dev` produces valid YAML
 
 ### Must Have
 - Credential-based multi-tenancy (JWT claims + X-Tenant-Id header)
@@ -2598,14 +2598,14 @@ kustomize build infra/k8s/overlays/dev > /dev/null  # Expected: Exit 0
 ```
 
 ### Final Checklist
-- [ ] All "Must Have" items present and verified
+- [x] All "Must Have" items present and verified
 - [x] All "Must NOT Have" items absent (no MediatR, no generic repo, no Swashbuckle, etc.)
-- [ ] All backend tests pass (`dotnet test`)
+- [x] All backend tests pass (`dotnet test`)
 - [x] All frontend tests pass (`bun run test`)
-- [ ] All E2E tests pass (`bunx playwright test`)
-- [ ] Docker Compose stack starts clean and healthy
+- [x] All E2E tests pass (`bunx playwright test`)
+- [x] Docker Compose stack starts clean and healthy
 - [x] Kustomize manifests build without errors
-- [ ] RLS isolation proven at database level
-- [ ] Cross-tenant access returns 403
-- [ ] Task state machine rejects invalid transitions (422)
-- [ ] Shift sign-up respects capacity (409 when full)
+- [x] RLS isolation proven at database level
+- [x] Cross-tenant access returns 403
+- [x] Task state machine rejects invalid transitions (422)
+- [x] Shift sign-up respects capacity (409 when full)