feat(infra): beheer portal in compose + e2e + ADR-0025 + demo note (refs #130)

tests/e2e/catalogus.spec.ts

@@ -0,0 +1,19 @@
+import { expect, test } from '@playwright/test';
+
+// S-15a walking skeleton: a beheerder logs in to the beheer portal (medewerker realm) and sees the
+// read-only ZTC catalogus. The verify stack seeds and publishes the BIG-REGISTRATIE zaaktype (the
+// same one verify-domain relies on), so it must appear in the catalogus. Runs against the shared
+// verify stack, so it asserts on that stable seeded zaaktype rather than anything test-specific.
+test('a beheerder sees the published zaaktypen in the catalogus', async ({ page }) => {
+  await page.goto('http://beheer/');
+
+  // The beheer portal redirects to the Keycloak medewerker realm login (same realm as behandel).
+  await page.locator('#username').fill('bram-beheerder');
+  await page.locator('#password').fill('test123');
+  await page.locator('#kc-login').click();
+
+  await expect(page.getByRole('heading', { name: /Catalogus/i })).toBeVisible();
+
+  // The seeded, published BIG zaaktype is shown by its business identificatie.
+  await expect(page.getByText('BIG-REGISTRATIE')).toBeVisible();
+});

tests/e2e/playwright.config.ts

@@ -6,6 +6,9 @@ const baseURL = process.env.SELF_SERVICE_URL ?? 'http://self-service';
 // The behandel portal is a second origin the happy path visits (staff approve from the werkbak);
 // it needs the same insecure-origin-as-secure treatment as self-service for the PKCE login (below).
 const behandelURL = process.env.BEHANDEL_URL ?? 'http://behandel';
+// The beheer portal is a third medewerker-realm origin (the read-only catalogus viewer, S-15a); it
+// needs the same insecure-origin-as-secure treatment as the others for the PKCE login (below).
+const beheerURL = process.env.BEHEER_URL ?? 'http://beheer';
 
 export default defineConfig({
   testDir: '.',
@@ -33,7 +36,7 @@ export default defineConfig({
     channel: 'chromium',
     launchOptions: {
       args: [
-        `--unsafely-treat-insecure-origin-as-secure=${baseURL},${behandelURL}`,
+        `--unsafely-treat-insecure-origin-as-secure=${baseURL},${behandelURL},${beheerURL}`,
         // Write Chromium's shared memory to /tmp instead of the container's small /dev/shm, so a
         // large DOM/heap can't crash the renderer on the memory-constrained runner (belt-and-braces
         // alongside the single worker above).