Add blocking accessibility gate: axe scans + keyboard-only onboarding coverage

[adamXbot]

Summary

Adds an accessibility regression gate to the E2E suite.

• tests/e2e/a11y.spec.ts — axe-core scans (WCAG 2.x A/AA; serious/critical block, minor/moderate logged) of the five highest-traffic surfaces: /welcome, onboarding text-entry + match steps, /dashboard, app detail, and the mobile nav drawer (scoped to nav.nav).
• tests/e2e/onboarding-keyboard.spec.ts — keyboard-only walk of the manual import path (passes today), plus a fixme-gated candidate-selection spec that becomes the regression guard once the candidate rows are converted to native controls.
• tests/e2e/helpers/axe.ts / keyboard.ts — shared harness: violation filtering + reporting, known-issue allowlist with stale-entry notices, tabTo reachability helper.

No CI changes needed: these specs run inside the existing Playwright step of the required quality job, so they block merges automatically.

Known-issue allowlist

Already-tracked defects are suppressed per rule + selector; each entry names its pending fix and must be deleted in the same PR as that fix — the harness prints a "known issue no longer detected — remove its allowlist entry" notice once a fix lands. New violations anywhere else fail immediately.

The first scans surfaced defects beyond the previously-known set, now allowlisted for fixing:

• link-name on the icon-only .nav-brand link (mobile)
• aria-hidden-focus: collapsed annotations sidebar keeps focusable children
• aria-required-children (critical): empty ImportedAppsTable renders its hint as the only child of a role="list" container
• ~15 color-contrast nodes across the scanned surfaces (full selector list = the contrast(…) entries in a11y.spec.ts)

Note: the unlabeled app-names textarea is deliberately not allowlisted — axe accepts placeholders as accessible names, so that rule never fires; its fix is tracked separately on WCAG grounds.

Dependency fix (second commit)

The quality job's pnpm audit --prod step fails on every branch since the 2026-07-22 advisory batch — unrelated to this PR's diff. fix(deps) clears it: next 16.2.11, dompurify 3.4.12, and a sharp ^0.35.0 override in the existing pnpm-workspace.yaml overrides block (Next still pins ^0.34.5 transitively; same documented-GHSA pattern as postcss / @babel/core). Other open PRs need this lockfile change or a rebase once merged.

Verification

• Full Playwright suite: 33 passed / 1 skipped (the intentional fixme), on a clean production build of next 16.2.11 with sharp 0.35.3.
• a11y specs run twice back-to-back with identical results.
• pnpm audit --prod clean; pnpm test (438 pass / 0 fail), pnpm typecheck, pnpm lint all green.

🤖 Generated with Claude Code

[adamXbot]

CI note: the initial quality failures were the pnpm audit --prod step hitting advisories that pre-date this PR's diff (today's Next.js batch — 4 high + 5 moderate fixed in 16.2.11 — plus sharp/libvips GHSA-f88m-g3jw-g9cj and dompurify GHSA-c2j3-45gr-mqc4). Any branch, including main, fails that gate today.

Pushed 4d0ec83 to clear them: next 16.2.11, dompurify 3.4.12, and a sharp ^0.35.0 override in the existing pnpm-workspace.yaml overrides block (Next still pins ^0.34.5 transitively; same documented-GHSA pattern as the postcss / @babel/core entries — drop when Next's range reaches ≥0.35).

Verified locally on the bumped stack: audit clean, typecheck, 438 unit tests, full Playwright suite (33 passed / 1 intentional fixme skip) on a clean production build. Note for other open PRs: each branch needs this lockfile change (or a rebase once this merges) before its own audit step goes green.

🤖 Generated with Claude Code