Door-level tests (no browser) for AC-1…AC-7: the role-gated nav, reusing the
passkey ceremony from the Account page, creating a user + emailing/showing the
invite, the invite path enrolling at /{GUID}, the passkey banner (shows without
a passkey, clears after adding one or opting out, suppressed on loopback), the
admin-only /users role gate, and no inline scripts on the new screens.
The harness now always wires the enroll/login flow (as the entrypoint does) and
the Credentials seam, so a test-supplied registry matches production.