feat: implement permissions and actions management

- Add permissions logic for status options in corrective actions.
- Create tests for permissions functionality.
- Implement queries for user authentication and actions management.
- Develop Actions page to display and manage corrective actions.
- Create authentication pages for login, setup, and password reset.
- Add IncidentDetail page to view incident details and associated actions.
- Implement Settings page for user management and password changes.

e2e/auth.spec.ts

@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test'
+import { PASSWORD, signIn, users } from './fixtures'
+
+test('sends visitors to sign in and back after', async ({ page }) => {
+  await page.goto('/incidents')
+  await expect(page).toHaveURL(/\/login$/)
+  await page.getByLabel('Email').fill(users.reporter.email)
+  await page.getByLabel('Password').fill(PASSWORD)
+  await page.getByRole('button', { name: 'Sign in', exact: true }).click()
+  await expect(page).toHaveURL(/\/incidents$/)
+})
+
+test('shows an error for a wrong password', async ({ page }) => {
+  await page.goto('/login')
+  await page.getByLabel('Email').fill(users.reporter.email)
+  await page.getByLabel('Password').fill('not the password')
+  await page.getByRole('button', { name: 'Sign in', exact: true }).click()
+  await expect(page.getByRole('alert')).toHaveText('Incorrect email or password')
+})
+
+test('offers an emailed sign-in link without revealing accounts', async ({ page }) => {
+  await page.goto('/login')
+  await page.getByRole('button', { name: 'Email me a sign-in link instead' }).click()
+  await page.getByLabel('Email').fill('nobody@e2e.test')
+  await page.getByRole('button', { name: 'Email me a sign-in link' }).click()
+  await expect(page.getByRole('status')).toContainText('If that email belongs to an account')
+})
+
+test('signs out', async ({ page, isMobile }) => {
+  await signIn(page, 'reporter')
+  if (isMobile) await page.getByRole('button', { name: 'Open menu' }).click()
+  await page.getByRole('button', { name: 'Sign out' }).click()
+  await expect(page).toHaveURL(/\/login$/)
+  await page.goto('/')
+  await expect(page).toHaveURL(/\/login$/)
+})
+
+test('loads with no third-party requests', async ({ page }) => {
+  const external: string[] = []
+  page.on('request', (request) => {
+    if (!request.url().startsWith('http://localhost')) external.push(request.url())
+  })
+  await signIn(page, 'reporter')
+  await page.evaluate(() => document.fonts.ready)
+  expect(await page.evaluate(() => document.fonts.check('16px "DM Sans Variable"'))).toBe(true)
+  expect(external).toEqual([])
+})