fix: accessibility improvements and test infrastructure hardening

Add aria-labels to form controls (selects, checkboxes, switches), set
html lang attribute and page title, fix color contrast for --candle-dim
and --text-faint tokens, underline inline links, remove opacity hack.
Harden dev login endpoints with atomic findOneAndUpdate and tokenVersion
in JWT. Update Playwright timeouts and E2E test helpers.

e2e/join-flow.spec.js

@@ -1,8 +1,48 @@
 import { test, expect } from '@playwright/test'
 
+// Mock Helcim API responses for join flow (avoids dependency on external API)
+function mockHelcimAPIs(page, { failCustomer = false } = {}) {
+  // Mock Helcim customer creation
+  page.route('**/api/helcim/customer', async (route) => {
+    if (failCustomer) {
+      return route.fulfill({
+        status: 409,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          statusCode: 409,
+          statusMessage: 'A member with this email already exists',
+          message: 'A member with this email already exists'
+        })
+      })
+    }
+    return route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        success: true,
+        customerId: 'test-cust-123',
+        customerCode: 'CUST-TEST-001'
+      })
+    })
+  })
+
+  // Mock subscription creation
+  page.route('**/api/helcim/subscription', async (route) => {
+    return route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        success: true,
+        subscription: { id: 'test-sub-123', status: 'ACTIVE' }
+      })
+    })
+  })
+}
+
 test.describe('Join page — member signup flow', () => {
   test('join form loads with all fields', async ({ page }) => {
     await page.goto('/join')
+    await page.waitForLoadState('networkidle')
 
     await expect(page.locator('#join-name')).toBeVisible()
     await expect(page.locator('#join-email')).toBeVisible()
@@ -15,6 +55,7 @@ test.describe('Join page — member signup flow', () => {
 
   test('submit button disabled when form incomplete', async ({ page }) => {
     await page.goto('/join')
+    await page.waitForLoadState('networkidle')
 
     // Clear name and email — circle defaults to community, contribution defaults to $15
     await page.locator('#join-name').fill('')
@@ -36,46 +77,40 @@ test.describe('Join page — member signup flow', () => {
     const uniqueEmail = `test-e2e-${Date.now()}@example.com`
 
     await page.goto('/join')
+    await page.waitForLoadState('networkidle')
 
+    // Fill in the form
     await page.locator('#join-name').fill('E2E Test User')
     await page.locator('#join-email').fill(uniqueEmail)
     await page.locator('#circle-community').check({ force: true })
     await page.locator('#join-contribution').selectOption('0')
 
     await expect(page.locator('.form-submit')).toBeEnabled()
+
+    // Mock Helcim APIs before submitting
+    await mockHelcimAPIs(page)
+
     await page.locator('.form-submit').click()
 
-    // Free tier skips payment (step 2) and goes to confirmation (step 3)
-    // or redirects to /welcome. Wait for either outcome.
-    await expect(
-      page.getByText('Welcome to Ghost Guild!').or(page.locator('.success-box'))
-    ).toBeVisible({ timeout: 15000 })
+    // Free tier creates subscription then shows confirmation (step 3)
+    await expect(page.locator('.success-box')).toBeVisible({ timeout: 15000 })
   })
 
   test('duplicate email shows error', async ({ page }) => {
-    // First submission — create a member
     const duplicateEmail = `test-e2e-dup-${Date.now()}@example.com`
 
     await page.goto('/join')
+    await page.waitForLoadState('networkidle')
+
+    // Mock customer endpoint to return 409 (email already exists)
+    await mockHelcimAPIs(page, { failCustomer: true })
+
     await page.locator('#join-name').fill('Dup Test User')
     await page.locator('#join-email').fill(duplicateEmail)
     await page.locator('#circle-community').check({ force: true })
     await page.locator('#join-contribution').selectOption('0')
     await page.locator('.form-submit').click()
 
-    // Wait for first submission to succeed
-    await expect(
-      page.getByText('Welcome to Ghost Guild!').or(page.locator('.success-box'))
-    ).toBeVisible({ timeout: 15000 })
-
-    // Navigate back and try to register the same email again
-    await page.goto('/join')
-    await page.locator('#join-name').fill('Dup Test User Again')
-    await page.locator('#join-email').fill(duplicateEmail)
-    await page.locator('#circle-community').check({ force: true })
-    await page.locator('#join-contribution').selectOption('0')
-    await page.locator('.form-submit').click()
-
     // Should show an error about the email already existing
     await expect(page.locator('.error-box')).toBeVisible({ timeout: 10000 })
     await expect(page.locator('.error-box')).toContainText(/already/i)