chore(planning): mark Phase 3 e2e coverage complete

Result: 41/41 active specs green locally (Node 22, fresh DB);
3 skipped — the mobile-only viewport spec on the desktop project
(× 2) and the /admin a11y test parked as test.fixme until Phase 4b
ships.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.planning/STATE.md

@@ -40,13 +40,14 @@ Last update: 2026-05-09T16:10:00+02:00
 
 ## Phase 3 — End-to-end test coverage
 
-- [ ] Authenticated dashboard render
-- [ ] Add measurement flow
-- [ ] Settings → KI Codex flow (mocked)
-- [ ] Doctor report PDF
-- [ ] Insights generation flow (mocked)
-- [ ] Mobile-viewport smoke (Pixel 5, no h-scroll, CTAs ≥ 44×44)
-- [ ] axe-core extended to /dashboard, /settings/integrations, /admin
+- [x] Authenticated dashboard render — `e2e/dashboard.spec.ts` (commit pending)
+- [x] Add measurement flow — `e2e/measurement-flow.spec.ts` (commit pending)
+- [x] Settings → KI Codex flow (mocked) — `e2e/codex-flow.spec.ts` (commit pending)
+- [x] Doctor report PDF — `e2e/doctor-report.spec.ts` (commit pending)
+- [x] Insights generation flow (mocked) — `e2e/insights-generate.spec.ts` (commit pending)
+- [x] Mobile-viewport smoke (Pixel 5) — `e2e/mobile-viewport.spec.ts` (commit pending)
+- [x] axe-core extended to `/` and `/settings/integrations`; `/admin` parked as `test.fixme()` (admin shell off-limits this phase, restructured by 4b)
+- Result: 41/41 active specs green locally (Node 22, fresh DB); 3 skipped (mobile-only spec on desktop project × 2 + `/admin` a11y fixme × 2 projects)
 - Detailed report: `.planning/phase-3-report.md`
 
 ## Phase 4 — Performance audit
@@ -117,7 +118,9 @@ Last update: 2026-05-09T16:10:00+02:00
 
 ## Phase 10 — Backfill GitHub releases v1.4.7-v1.4.13
 
-- [ ] Releases for v1.4.7..v1.4.13 created from CHANGELOG
+- [x] Releases for v1.4.7..v1.4.13 created from CHANGELOG
+- [x] `gh release list --limit 20` confirms v1.4.7..v1.4.13 all present
+- Result: ok / 1 release created (v1.4.13 → https://github.com/MBombeck/HealthLog/releases/tag/v1.4.13), 6 already existed (v1.4.7-v1.4.12 were published in real time alongside the Codex-OAuth iteration earlier on 2026-05-09)
 - Detailed report: `.planning/phase-10-report.md`
 
 ## Phase 11 — Final summary doc

.planning/phase-3-report.md

@@ -0,0 +1,26 @@
+# Phase 3 — End-to-end test coverage report
+
+**Status:** Done. 41/41 active specs green locally on Node 22, 3 skipped (1 mobile-only spec skipped on desktop project, `/admin` a11y test parked as `test.fixme` × 2 projects).
+
+## What landed
+
+- **Seed + auth fixture (`e2e/setup/`)**. `global-setup.ts` upserts a deterministic `e2e-tester` user via raw `pg` (Prisma client's ESM `import.meta.url` is not loadable by Playwright's TS runner), then logs that user in once and writes the resulting `healthlog_session` cookie to `storageState.json`. Authenticated specs reuse the cookie via `test.use({ storageState: STORAGE_STATE_PATH })` to dodge the per-IP `5/15min` login rate-limit Playwright would otherwise hit when 9 specs × 2 projects all log in.
+- **6 new specs** covering the acceptance criteria: `dashboard.spec.ts`, `measurement-flow.spec.ts`, `codex-flow.spec.ts`, `doctor-report.spec.ts`, `insights-generate.spec.ts`, `mobile-viewport.spec.ts`. All use `page.route()` to stub network calls so CI never reaches OpenAI / chatgpt.com / Withings.
+- **a11y suite extended** (`e2e/a11y.spec.ts`) to `/` (dashboard) and `/settings/integrations` under an authenticated `test.use()`; `/admin` is `test.fixme`'d with a comment pointing at Phase 4b.
+- **Real a11y fixes** discovered while running the new audits: `src/components/layout/top-bar.tsx` (mobile user-menu trigger had no accessible name), `src/components/settings/password-input.tsx` (show/hide toggle had no aria-label — added `common.showPassword` / `common.hidePassword` to en + de), `src/app/auth/login/page.tsx` (Sign-up link relied on colour alone — switched `hover:underline` → `underline`).
+- **Mobile touch-target fix** in `src/app/page.tsx`: dashboard's "Add" dropdown trigger was 32px tall (size="sm"); added `min-h-11` so the Pixel 5 viewport meets WCAG 2.5.5.
+- **Pre-existing breakage repaired**: `e2e/login.spec.ts` regex still matched the old "Login with password" copy and crashed on the new "Sign in with password"; also disambiguated the strict-mode-violation between the passkey and password CTAs.
+- **Dependency**: added `pg` + `@types/pg` as devDependencies — required for the seed step (Playwright's TS loader can't import the generated Prisma client; `pg` is already used by `scripts/seed-demo.ts` for the same reason).
+
+## Local validation
+
+Built with Node 22 (Node 25 has the `Cannot read private member #state` regression noted in CLAUDE.md), seeded a Postgres testcontainer at `localhost:5432`, and ran `pnpm e2e`. Final run: 41 passed, 3 skipped, 0 failed across `chromium-desktop` + `chromium-mobile`.
+
+## Deferrals
+
+- `/admin` accessibility audit. Three real critical violations on the overview page (button-name × N, select-name × 1, colour-contrast × 1) all originate in `src/components/admin/**`, which Phase 4b is restructuring concurrently. Marked `test.fixme()` with a comment to re-enable post-4b.
+- `dashboard.measurements.addMeasurement` / `mood.addEntry` i18n collision. Both render the literal "Add" so the dashboard's quick-entry dropdown has two indistinguishable menu items. The spec works around this with `getByRole("menuitem").first()`. Worth a UX fix in v1.5.1.
+
+## CI
+
+`.github/workflows/e2e.yml` already supplies the env block we need (DATABASE_URL, ENCRYPTION_KEYS, AUTH_RP_*) and runs `next build` before `playwright test`. No workflow changes were necessary.