fix(frontend): stabilize RBAC forbidden checks with admin-route testid

Agent-Logs-Url: https://github.com/bg-playground/BGSTM/sessions/96c7b666-e2a6-40ba-9d39-1dadf63afe5f

Co-authored-by: bg-playground <259109604+bg-playground@users.noreply.github.com>

Author: Copilot

frontend/src/components/AdminRoute.tsx

@@ -9,7 +9,7 @@ const AdminRoute: React.FC<{ children: React.ReactNode }> = ({ children }) => {
   if (!isAuthenticated) return <Navigate to="/login" replace />;
   if (user?.role !== 'admin') {
     return (
-      <div className="flex flex-col items-center justify-center min-h-[60vh] text-center">
+      <div data-testid="admin-route-forbidden" className="flex flex-col items-center justify-center min-h-[60vh] text-center">
         <h1 className="text-4xl font-bold text-gray-800 mb-4">403</h1>
         <p className="text-lg text-gray-600">Access Denied — Admin only.</p>
       </div>

frontend/tests/e2e/rbac.spec.ts

@@ -25,10 +25,7 @@ test.describe('RBAC – Viewer role', () => {
     // 3. Redirect to login
     const url = page.url();
     const wasRedirected = !url.includes('/admin') || url.includes('/login');
-    const showsForbidden = await page
-      .getByText(/403|unauthorized|forbidden|access denied|not authorized/i)
-      .isVisible()
-      .catch(() => false);
+    const showsForbidden = await page.getByTestId('admin-route-forbidden').isVisible().catch(() => false);
     const showsEmptyOrError = await page
       .getByText(/no users|error|something went wrong/i)
       .isVisible()
@@ -94,7 +91,7 @@ test.describe('RBAC – Admin role', () => {
     expect(page.url()).not.toMatch(/\/login/);
 
     // Should NOT see a 403/forbidden page
-    const isForbidden = await page.getByText(/403|forbidden|access denied/i).isVisible().catch(() => false);
+    const isForbidden = await page.getByTestId('admin-route-forbidden').isVisible().catch(() => false);
     expect(isForbidden).toBe(false);
   });
-});
+});