feat: add testing infrastructure — Vitest, Playwright, CI, git hooks

Add comprehensive testing covering 420 unit/handler tests across 24 Vitest
files, 9 Playwright E2E specs, accessibility scans, and visual regression.
Includes GitHub Actions CI, Husky pre-push hook, and TESTING.md docs.

e2e/auth.spec.js

@@ -0,0 +1,54 @@
+import { test, expect } from '@playwright/test'
+import { loginAsAdmin, loginAsMember } from './helpers/auth.js'
+
+test.describe('Authentication flows', () => {
+  test('protected page shows login modal when logged out', async ({ page }) => {
+    // Navigate to a protected member page without being logged in
+    await page.goto('/member/dashboard')
+
+    // The auth middleware aborts navigation and shows the login modal
+    // Look for the modal title and email input
+    await expect(page.getByText('Sign in to continue')).toBeVisible()
+    await expect(page.locator('input[type="email"]')).toBeVisible()
+    await expect(page.getByRole('button', { name: 'Send magic link' })).toBeVisible()
+  })
+
+  test('admin login and redirect', async ({ page }) => {
+    await loginAsAdmin(page)
+
+    // loginAsAdmin waits for /admin URL
+    await expect(page).toHaveURL(/\/admin/)
+
+    // Admin layout should show admin sidebar content
+    await expect(page.locator('.sidebar-nav').getByText('Members')).toBeVisible()
+    await expect(page.locator('.admin-tag')).toBeVisible()
+  })
+
+  test('member login and redirect', async ({ page }) => {
+    await loginAsMember(page, 'test-admin@ghostguild.dev')
+
+    // loginAsMember waits for /member/ URL
+    await expect(page).toHaveURL(/\/member\//)
+  })
+
+  test('logout clears auth', async ({ page }) => {
+    // Login as admin first
+    await loginAsAdmin(page)
+    await expect(page).toHaveURL(/\/admin/)
+
+    // Click the "Sign out" link in the sidebar meta area
+    await page.locator('.sidebar-meta a').filter({ hasText: 'Sign out' }).click()
+
+    // Should redirect to home after logout
+    await page.waitForURL('/')
+
+    // Verify the auth-token cookie is cleared
+    const cookies = await page.context().cookies()
+    const authCookie = cookies.find((c) => c.name === 'auth-token')
+    expect(!authCookie || authCookie.value === '').toBeTruthy()
+
+    // Navigating to a protected page should show the login modal
+    await page.goto('/member/dashboard')
+    await expect(page.getByText('Sign in to continue')).toBeVisible()
+  })
+})