test(web-app-gitlab): assert the admin area instead of the word GitLab

The administrator persona's interaction accepted `projects`, `groups` and
`settings` as its target, which any signed-in user reaches, skipped its
whole body when no link matched, swallowed the click's failure, and then
asserted the page contained one of `project|group|merge request|issue|admin
area|gitlab`. The last alternative is the defect: GitLab prints its own name
on the 404 page, so the assertion passed precisely when the admin area was
not reached. The locator now accepts only the admin entry, across the label
spellings GitLab has shipped, the click is allowed to throw, and the landing
is checked by URL rather than by page copy, which survives a renamed heading
and does not depend on the interface language.

This is expected to fail while it runs. The persona signs in as
`platform_administrator`, and nothing makes that account a GitLab admin:
the image is `gitlab-webservice-ce` (meta/services.yml), Community Edition
maps no OIDC group to admin, templates/config/gitlab.yml.j2 sets no
`admin_groups`, and the role performs no promotion after the first sign-in.
`/admin` therefore answers 404 and the entry is never rendered. The old
assertion hid exactly that. The callback runs in the two of three variants
that enable sso.

The fix belongs in the role, not in the spec: provision the account natively
with admin rights and let `auto_link_user: ["openid_connect"]`, already set
in gitlab.yml.j2, bind the OIDC identity to it. That covers both sso states
with one identity, where a promotion after the first login would leave a
fresh deployment without an administrator under the declared name until
someone signs in. Until then `root` holds the admin rights while carrying
`platform_administrator`'s password, so one secret opens two doors with
different privileges.

mobilizon and port-ui share the shape: both run the persona without an
administrator behind it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-gitlab/files/playwright/playwright.spec.js

@@ -107,18 +107,15 @@ test("biber: app → universal logout", async ({ page }) => {
 test("administrator: app → universal logout", async ({ page }) => {
   await runAdminFlow(page, {
     adminInteraction: async (interactivePage) => {
-      // web-app-gitlab admin-only interaction: open a management surface.
       const link = interactivePage
-        .getByRole("link", { name: /^(projects|groups|admin|settings)$/i })
+        .getByRole("link", { name: /^admin(\s*area)?$/i })
         .first();
-      if (await link.isVisible().catch(() => false)) {
-        await link.click({ timeout: resolveTimeout(30_000) }).catch(() => {});
-        await interactivePage.waitForLoadState("domcontentloaded", { timeout: resolveTimeout(30_000) }).catch(() => {});
-        await expect(interactivePage.locator("body")).toContainText(
-          /project|group|merge request|issue|admin area|gitlab/i,
-          { timeout: resolveTimeout(30_000) },
-        );
-      }
+      await expect(link).toBeVisible({ timeout: resolveTimeout(30_000) });
+      await link.click({ timeout: resolveTimeout(30_000) });
+      await interactivePage.waitForLoadState("domcontentloaded", { timeout: resolveTimeout(30_000) }).catch(() => {});
+      await expect(interactivePage).toHaveURL(/\/admin/, {
+        timeout: resolveTimeout(30_000),
+      });
     },
   });
 });