fix(e2e): assert the journey lander contract that #127 shipped (#128)

#127 made an anonymous hit on the /journey root land on /start instead of
the signin form, but left e2e/smoke.spec.ts asserting the old contract.
That PR was merged 100 seconds after opening while its checks were still
pending, and its e2e run went red afterwards. e2e.yml triggers on
pull_request only, never on push to main, so nothing re-ran and nothing
reported it. main has been shipping a behavior its own suite contradicts,
and every PR opened since inherits the failure: #125 and #126 are pure
bun.lock changes and both fail on this test.

The code is right and the test was stale, so the test moves.

Splits the unauthenticated case in two rather than just repointing the
URL. ANONYMOUS_LANDERS in proxy.ts is keyed on the exact stripped path,
so /journey diverts to /start while every deeper app URL still walls to
signin with callbackUrl preserved. Asserting only the lander would stop
proving anything about auth, which is what the original test was for;
asserting only the wall would not notice the lander regressing back to a
login form. /de/risks covers the second half and is already exercised
elsewhere in the suite.

de is the default locale under localePrefix "as-needed", so the lander
target carries no locale prefix: /de/journey resolves to /start.

Not verified locally: the suite needs Postgres, a seeded database and a
production build, so CI is the check here.


Claude-Session: https://claude.ai/code/session_01J93t7LS29yZq2app1Pqsmn

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: simonorzel26

e2e/smoke.spec.ts

@@ -13,18 +13,43 @@ test("journey renders all 49 NIS2 requirement nodes", async ({ page }) => {
 });
 
 /**
- * Proves the smoke above is not passing vacuously: without the session,
- * the default-deny middleware must bounce /journey to the signin form.
+ * Proves the smoke above is not passing vacuously: without a session the
+ * journey must not render.
+ *
+ * How that is enforced for the /journey root changed in #127. Anonymous
+ * visitors used to meet the signin form; they now land on /start, the
+ * public pre-login page, because /start had recorded zero visits while
+ * nothing linked to it. Default-deny is unchanged everywhere else:
+ * ANONYMOUS_LANDERS in proxy.ts is keyed on the exact stripped path, so
+ * only the root is diverted and every deeper app URL still walls to
+ * signin with callbackUrl preserved.
+ *
+ * Both halves are asserted. The lander on its own no longer proves
+ * anything about auth, and the wall on its own would not notice the
+ * lander regressing back to a login form.
+ *
+ * de is the default locale under localePrefix "as-needed", so the lander
+ * target carries no locale prefix: /de/journey resolves to /start.
  */
 test.describe("unauthenticated", () => {
   test.use({ storageState: { cookies: [], origins: [] } });
 
-  test("journey redirects to signin without a session", async ({ page }) => {
+  test("the journey root lands anonymous visitors on /start", async ({
+    page,
+  }) => {
     await page.goto("/de/journey");
+    await page.waitForURL(/\/start$/, { timeout: 15_000 });
+    await expect(page.locator('[data-testid^="journey-node-"]')).toHaveCount(
+      0,
+    );
+  });
+
+  test("a deeper app URL still walls to signin with callbackUrl", async ({
+    page,
+  }) => {
+    await page.goto("/de/risks");
     await page.waitForURL(/\/auth\/signin/, { timeout: 15_000 });
+    expect(page.url()).toContain("callbackUrl");
     await expect(page.locator("#email")).toBeVisible();
-    await expect(
-      page.locator('[data-testid^="journey-node-"]'),
-    ).toHaveCount(0);
   });
 });