§8 full browser E2E (todo §8); the real Playwright UI against the live stack — the browser-UI flows the earlier full-stack suites deferred here. New e2e/full-flow.spec.ts + compose.e2e-full.yml covering password login, mocked SSO, menu filtering by role, users/groups/roles CRUD, a permission-gated plugin page, and logout (6/6 green on a clean stack, then torn down). Same-origin gateway (e2e/proxy.mjs, stdlib reverse proxy) fronts web + Kratos on one host so the browser's cookies round-trip (the themed form posts straight to Kratos); ory/kratos/e2e-proxy.yml points Kratos at it + --dev so cookies aren't Secure over http. SSO backed by a stdlib mock OIDC provider (e2e/mock-oidc.mjs, RS256 id_token, nonce-bound codes). Found + fixed a real bug the E2E surfaced: the SSO submit button shares the form with the required email/password fields, so HTML5 validation blocked it — added formnovalidate to the SSO buttons (auth-card.ejs), tests-first. Stability-reviewer APPROVE, no Critical/High (every dev/insecure knob is e2e-overlay-scoped, base/prod compose unaffected). typecheck + 305 units green. Also marks the §8 E2E-harness item (full stack up + seeded admin/Keto roles + tear-down).

README.md

@@ -219,7 +219,7 @@ otherwise drags up its `depends_on` services.
 ### End-to-end (Playwright)
 
 E2E runs in the official Playwright image (browsers preinstalled) against the live `web`
-service — no Node/browsers on the host. There are two suites:
+service — no Node/browsers on the host. There are four suites:
 
 **Visual + design system** (`visual.spec.ts`) — Ory-free (mock-data dashboard), so it stays fast.
 It screenshots the live pages **and** the `html-css-foundation` mockups, then asserts the live DOM
@@ -253,6 +253,18 @@ docker compose -f compose.yml -f compose.e2e-oauth.yml run --build --rm e2e   #
 docker compose -f compose.yml -f compose.e2e-oauth.yml down -v                 # tear down after
 ```
 
+**Full browser flow** (`full-flow.spec.ts`) — the real Playwright UI against the live stack: the
+themed **password login** and a **mocked-SSO** login (an in-network mock OIDC provider,
+`e2e/mock-oidc.mjs`), **menu filtering by role**, the **users/groups/roles** admin CRUD, a
+permission-gated **plugin page**, and **logout**. Because the themed form posts straight to Kratos
+and cookies are host-scoped, a tiny same-origin gateway (`e2e/proxy.mjs`) fronts web + Kratos on one
+host (`ory/kratos/e2e-proxy.yml` points Kratos at it) — exactly as a production reverse proxy would.
+
+```bash
+docker compose -f compose.yml -f compose.e2e-full.yml run --build --rm e2e   # run the suite
+docker compose -f compose.yml -f compose.e2e-full.yml down -v                 # tear down after
+```
+
 `--build` rebuilds the runner so spec edits are always picked up (the image bakes in `e2e/`).
 
 Screenshots + an HTML report land in `e2e/artifacts/` (git-ignored). Every user-facing flow