test(e2e): realign fixtures with the live app (account-age GitHub gate, account-menu marker, non-member join CTA)

The e2e suite carried pre-existing drift against the current app, unrelated to
the demo-sub seed change:

- github-dev gates on an account-age badge (provider=github, >= 12 months), but
  the mock issuer had no account-age profile and specs 06/09 disclosed
  oauth-account, so every GitHub join failed the gate. Add an account-age badge
  to the mock catalog and disclose it from those specs.
- The signed-in nav marker moved from a 'signed in' text span to the gear
  'Account menu' button; expectSignedIn now asserts that button.
- A signed-in non-member's composer suppresses the full-width denied card in
  favor of the sub-forum's Join CTA, so 08b now asserts the 'Join to post'
  prompt and the absence of a New-post button.

Author: AtHeartEngineer

e2e/06-poll.spec.ts

@@ -12,7 +12,7 @@ import { GITHUB_SLUG, GITHUB_ROLE } from './harness/env';
 test('create a poll post and vote, then see the result view', async ({ page }) => {
 	await joinSubforum(page, {
 		email: 'pollster@acme.example',
-		badges: ['oauth-account'],
+		badges: ['account-age'],
 		slug: GITHUB_SLUG,
 		role: GITHUB_ROLE,
 		pseudonym: 'Pollster'

e2e/08-gate-denied.spec.ts

@@ -3,23 +3,25 @@
 // Two angles on the badge gate:
 //
 //  (a) JOIN gate: a user who discloses only an email-domain badge tries to join
-//      the GitHub-verified-devs sub-forum (which requires an oauth-account github
+//      the GitHub-verified-devs sub-forum (which requires an account-age github
 //      badge). Minister discloses nothing satisfying, the server re-runs the gate
 //      on the verified disclosure, and the join is REJECTED - the join page
 //      surfaces the failure rather than confirming membership.
 //
 //  (b) Composer gate: a signed-in NON-member viewing the public Ask-an-expert
 //      sub-forum is NOT offered the answer/post affordance (the gate hides the
-//      control it would 403). The "you don't have permission" notice shows
-//      instead of a New-post button.
+//      control it would 403). A "Join to post" CTA shows in place of a New-post
+//      button (the composer's full-width denied card is suppressed for a
+//      non-member since the prominent Join CTA already explains how to gain
+//      posting access - see PostComposer `hideDeniedCard`).
 
 import { test, expect } from '@playwright/test';
 import { signInWithMinister } from './harness/helpers';
 import { GITHUB_SLUG, GITHUB_ROLE, ASK_SLUG } from './harness/env';
 
 test('join gate rejects a disclosure that does not satisfy the role', async ({ page }) => {
 	// Sign in to join github-devs but disclose only email-domain (NOT the required
-	// oauth-account github badge). The mock issuer mints nothing satisfying.
+	// account-age github badge). The mock issuer mints nothing satisfying.
 	await signInWithMinister(page, {
 		email: 'wrong-badge@acme.example',
 		badges: ['email-domain'],
@@ -41,14 +43,12 @@ test('a signed-in non-member is not offered the post affordance in Ask-an-expert
 }) => {
 	// Identity-only sign-in: the user is authenticated but is NOT a member of the
 	// public Ask-an-expert sub-forum. The public role may `ask`/read but holds no
-	// `post:*`/`answer` grant, so the post composer must render its denied state
-	// (the gate hides a control it would 403) rather than a New-post button.
+	// `post:*`/`answer` grant, so the gate hides the post affordance: no New-post
+	// button, and a "Join to post" CTA takes its place.
 	await signInWithMinister(page, { email: 'reader@acme.example', badges: ['email-domain'] });
 	await expect(page).toHaveURL(/\/$/);
 
 	await page.goto(`/s/${ASK_SLUG}`);
-	await expect(
-		page.getByText("You don't have permission to post here", { exact: false })
-	).toBeVisible();
+	await expect(page.getByText('to post, comment, and react', { exact: false })).toBeVisible();
 	await expect(page.getByRole('button', { name: 'New post' })).toHaveCount(0);
 });

e2e/09-github-badge-join.spec.ts

@@ -3,12 +3,12 @@
 //
 // The counterpart to spec 8a (deny): there, a user disclosing only an
 // email-domain badge is REJECTED from github-devs. Here the user discloses the
-// required oauth-account (provider=github) badge, so the whole disclosure path
-// runs green end to end:
+// required account-age (provider=github, >= 12 months) badge, so the whole
+// disclosure path runs green end to end:
 //
 //   /api/auth/oidc/start?subforum=github-devs&role=github-dev
-//     -> the role's policy { badge: oauth-account, where: { provider: github } }
-//        rides along as `minister_policy` and adds the `badge:oauth-account`
+//     -> the role's policy { badge: account-age, where: { provider: github } }
+//        rides along as `minister_policy` and adds the `badge:account-age`
 //        scope, so the mock issuer discloses exactly that badge (minimal set);
 //   -> the callback re-verifies the id_token + the disclosed VC and stashes a
 //        single-use pending-join;
@@ -24,10 +24,10 @@ import { test, expect } from '@playwright/test';
 import { joinSubforum } from './harness/helpers';
 import { GITHUB_SLUG, GITHUB_ROLE } from './harness/env';
 
-test('joins github-devs by disclosing a GitHub oauth-account badge', async ({ page }) => {
+test('joins github-devs by disclosing a GitHub account-age badge', async ({ page }) => {
 	await joinSubforum(page, {
 		email: 'join-dev@acme.example',
-		badges: ['oauth-account'],
+		badges: ['account-age'],
 		slug: GITHUB_SLUG,
 		role: GITHUB_ROLE,
 		pseudonym: 'OctoJoiner'

e2e/harness/env.ts

@@ -75,7 +75,7 @@ export const COMPANY_DOMAIN = 'acme.example';
 export const COMPANY_SLUG = 'acme-employees';
 export const COMPANY_ROLE = 'employee';
 
-/** GitHub-verified devs: oauth-account provider=github. */
+/** GitHub-verified devs: account-age provider=github (>= 12 months, no handle). */
 export const GITHUB_SLUG = 'github-devs';
 export const GITHUB_ROLE = 'github-dev';
 

e2e/harness/helpers.ts

@@ -42,9 +42,12 @@ export async function signInWithMinister(page: Page, opts: SignInOpts): Promise<
 	await Promise.all([page.waitForURL(/localhost/), page.click('#approve')]);
 }
 
-/** Assert the top-nav shows the signed-in marker (the user landed authenticated). */
+/** Assert the top-nav shows the signed-in marker (the user landed authenticated).
+ *  The signed-in state renders the gear-triggered account menu (aria-label
+ *  "Account menu"); a signed-out nav shows the "Sign in with Minister" button
+ *  instead, so the menu button's presence is the authenticated marker. */
 export async function expectSignedIn(page: Page): Promise<void> {
-	await expect(page.getByText('signed in')).toBeVisible();
+	await expect(page.getByRole('button', { name: 'Account menu' })).toBeVisible();
 }
 
 export interface JoinOpts {

e2e/mock-oidc/issuer.ts

@@ -219,6 +219,14 @@ const BADGE_CATALOG: Record<string, MockBadge> = {
 		type: 'oauth-account',
 		attributes: { provider: 'github', accountId: 'gh-e2e-1' }
 	},
+	// The launch GitHub-Verified Devs role gates on account AGE (provider=github,
+	// >= 12 months), not the oauth-account handle. `olderThanMonths` is the coarse
+	// lower-bound bucket Minister discloses; the role policy only constrains
+	// `provider`, so any bucket satisfies it.
+	'account-age': {
+		type: 'account-age',
+		attributes: { provider: 'github', olderThanMonths: 12 }
+	},
 	'invite-code': { type: 'invite-code', attributes: { label: 'WELCOME' } },
 	'age-over-21': { type: 'age-over-21', attributes: { threshold: 21 } }
 };
@@ -346,6 +354,7 @@ async function handle(req: IncomingMessage, res: ServerResponse, issuer: string)
 				'profile',
 				'badge:email-domain',
 				'badge:oauth-account',
+				'badge:account-age',
 				'badge:invite-code',
 				'badge:age-over-21'
 			],