fix(web-app-funkwhale): scope the sign-in fields to the login form

The spec picked its username field with a global input[type=text]:visible .first(). Funkwhale's header carries a search field, so whenever that renders before the login input in DOM order the credentials would go into the search box and the run would fail later, at the password field, with a misleading message. Anchor both fields to form:has(input[type=password]) instead, letting the password field define which form is meant.

Also wait for the URL to leave the canonical domain before driving the Keycloak form. Without it a proxy that fails to intercept /login surfaces as a bare 60 second timeout inside the shared Keycloak helper, with nothing pointing at the missing redirect. The pattern is taken from roles/web-app-n8n/files/playwright/_shared.js, which runs the same chain and is green in CI.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-funkwhale/files/playwright/test-native-login.js

@@ -38,6 +38,12 @@ for (const persona of PERSONAS) {
     await page.goto(`${appBaseUrl}/login`, { waitUntil: "domcontentloaded" });
 
     if (ssoEnabled) {
+      await expect
+        .poll(() => page.url(), {
+          timeout: 60_000,
+          message: "the oauth2 ACL protects /login, so the proxy must hand the persona to Keycloak",
+        })
+        .not.toContain(canonicalDomain);
       await performKeycloakLoginForm(page, persona.username, persona.password);
       await expect
         .poll(() => page.url(), {
@@ -47,14 +53,15 @@ for (const persona of PERSONAS) {
         .toContain(canonicalDomain);
     }
 
-    const password = page.locator("input[type='password']:visible").first();
+    const loginForm = page.locator("form:has(input[type='password'])").first();
+    const password = loginForm.locator("input[type='password']").first();
     await expect(
       password,
       "Funkwhale serves its own sign-in form on /login; the proxy only gates the route, it does not create an application session",
     ).toBeVisible({ timeout: 60_000 });
 
-    await page
-      .locator("input[type='text']:visible, input[type='email']:visible")
+    await loginForm
+      .locator("input[type='text'], input[type='email']")
       .first()
       .fill(persona.username);
     await password.fill(persona.password);