Add automated accessibility testing (axe-core on the existing Playwright surface)

[solarssk]

Context

Verified empirically (2026-09-23): no axe-core, Pa11y, or Lighthouse anywhere in this repo (grep -rli "axe-core|pa11y|lighthouse" across *.json/*.ts/*.yml - zero hits outside node_modules). This is a real, currently-unaddressed gap, not a false alarm from an external review.

Proposal

Rather than building a new, separate crawler-based a11y pipeline, add @axe-core/playwright to the existing browser-level test surface (apps/admin/e2e/, currently just checkin.spec.ts - see PR #1410 for its recent promotion into ci.yml as a path-aware PR gate). This repo already has real auth, fixtures, and a genuine authenticated browser session wired up there, which a standalone crawler (Pa11y/Lighthouse CI) would have to duplicate from scratch and wouldn't cover post-login views at all.

Suggested scope, in order:

1. Add @axe-core/playwright as a devDependency of apps/admin.
2. Start with the surfaces that already have (or are about to have) a Playwright presence: login/setup, the check-in page, attendee list/detail, event settings, communication.
3. First pass: report-only (log serious/critical violations to the job summary, don't fail the build) - this repo already has real accumulated UI, so a blocking gate from day one would likely surface a backlog of pre-existing issues unrelated to whatever PR happens to touch that surface first.
4. Once the baseline is clean (or explicitly triaged/allowlisted), flip serious/critical violations to build-failing, following the same "prove it green first, then gate" pattern this repo already used for e2e-checkin-smoke.yml (14-run bar) and the license-compliance check (continue-on-error: true today, see scripts/check-licenses.mjs).

Out of scope for this issue

• A separate Pa11y/Lighthouse CI pipeline - the Playwright-based approach above supersedes that need.
• Fixing any violations found - this issue is about wiring up detection, not remediation (file follow-up issues once a baseline report exists).

[solarssk]

Status after #1418 and #1422:

• Done: axe-core scan (WCAG 2 A/AA, 2.1 A/AA) in apps/admin/e2e/a11y.spec.ts on the login page and the operator check-in page; runs in CI via the e2e-checkin-smoke job. Its first finding (color contrast on the check-in page) is fixed, and serious/critical violations now fail the test (minor/moderate stay report-only).
• Remaining: attendee list/detail, event settings and communication. They need an admin-role account in the E2E seed (today only an operator is seeded). Then extend the same spec to those pages.

[solarssk]

Done in #1410 and #1424.

• The Playwright + axe-core accessibility scan now covers 8 surfaces: the public pages, the check-in view and 6 admin pages (Overview, Attendees, Reports, Communication, Settings, Audit log), signed in as a seeded superadmin (TOTP enrollment handled by the test helper).
• WCAG 2.0/2.1/2.2 A+AA rules run on every surface; serious and critical violations fail the job, minor and moderate ones are reported in the job summary.
• The scan runs in e2e-checkin-smoke whenever a path that can affect these surfaces changes.
• Real findings fixed along the way: contrast on the check-in tabs, success button, empty states, live indicator and the attendee item states.

Out of scope, as stated in the issue: triaging moderate/minor findings and adding more surfaces later.