merge: worktree-a11y-fixes into main

Accessibility fixes (aria-labels, color contrast, html lang, inline link
underlines), atomic dev login endpoints, and E2E test hardening.

server/api/dev/member-login.get.js

@@ -34,7 +34,7 @@ export default defineEventHandler(async (event) => {
 
   const config = useRuntimeConfig(event);
   const token = jwt.sign(
-    { memberId: member._id, email: member.email, tv: member.tokenVersion },
+    { memberId: member._id, email: member.email, tv: member.tokenVersion || 0 },
     config.jwtSecret,
     { expiresIn: "7d" },
   );
@@ -43,6 +43,7 @@ export default defineEventHandler(async (event) => {
     httpOnly: true,
     secure: false,
     sameSite: "lax",
+    path: "/",
     maxAge: 60 * 60 * 24 * 7,
   });
 

server/api/dev/test-login.get.js

@@ -13,23 +13,24 @@ export default defineEventHandler(async (event) => {
 
   await connectDB();
 
-  // Find or create a test admin user
-  let member = await Member.findOne({ email: "test-admin@ghostguild.dev" });
-
-  if (!member) {
-    member = await Member.create({
-      email: "test-admin@ghostguild.dev",
-      name: "Test Admin",
-      circle: "founder",
-      contributionTier: "0",
-      role: "admin",
-      status: "active",
-    });
-  }
+  // Find or create a test admin user (atomic to avoid race conditions in parallel tests)
+  const member = await Member.findOneAndUpdate(
+    { email: "test-admin@ghostguild.dev" },
+    {
+      $setOnInsert: {
+        name: "Test Admin",
+        circle: "founder",
+        contributionTier: "0",
+        role: "admin",
+        status: "active",
+      },
+    },
+    { upsert: true, new: true },
+  );
 
   const config = useRuntimeConfig(event);
   const token = jwt.sign(
-    { memberId: member._id, email: member.email, tv: member.tokenVersion },
+    { memberId: member._id, email: member.email, tv: member.tokenVersion || 0 },
     config.jwtSecret,
     { expiresIn: "7d" },
   );
@@ -38,6 +39,7 @@ export default defineEventHandler(async (event) => {
     httpOnly: true,
     secure: false,
     sameSite: "lax",
+    path: "/",
     maxAge: 60 * 60 * 24 * 7,
   });