test(a11y): add axe-core WCAG A/AA scans to accessibility suite

[BigSimmo]

Summary

• Adds @axe-core/playwright (MIT/MPL-2.0, dev-only) and two automated WCAG A/AA scans to tests/ui-accessibility.spec.ts, turning test:e2e:accessibility from manual role/aria assertions into real axe coverage.
• Default-colors desktop scan asserts the full rule set including color-contrast; forced-colors mobile scan disables color-contrast (forced-colors palettes invalidate it).
• Scans fail only on critical/serious impact violations and attach the full violation JSON to the test report for triage of lower-impact findings.
• Both scans run after the existing expectDashboardUsable readiness gate so the hydration double-render cannot produce false positives, and are untagged so they stay in the advisory e2e lane (no new required checks).

Verification

• npm run test:e2e:accessibility — 5/5 passed twice consecutively (3 existing + 2 new scans); zero blocking violations found on the dashboard shell.
• npm run verify:cheap — green (1948 unit tests, lint, typecheck, runtime/pin/sitemap checks).
• npm run format — clean.

Notes

• No runtime code touched; test + devDependency change only.
• Clinical governance preflight: not applicable (no ingestion/answer/search/privacy surface).

🤖 Generated with Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7f47410b-ebc9-4be1-98b5-5caf031af306

📥 Commits

Reviewing files that changed from the base of the PR and between b8b4843 and 0c6b3e5.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• tests/ui-accessibility.spec.ts

---

📝 Walkthrough

Summary by CodeRabbit

• Tests
  • Added automated accessibility checks for critical and serious WCAG violations.
  • Added accessibility coverage for default and forced-color display modes.
  • Accessibility results are now included in test reports.

Walkthrough

The UI accessibility suite now integrates axe-core Playwright scans for default and forced-colors modes, attaches scan results to reports, and fails on serious or critical WCAG violations.

Changes

Accessibility scan coverage

Layer / File(s)	Summary
Axe scan configuration and reporting package.json, tests/ui-accessibility.spec.ts	Adds @axe-core/playwright, configures WCAG A/AA tags, attaches complete violation results, and blocks serious or critical findings.
Default and forced-colors scan tests tests/ui-accessibility.spec.ts	Adds dashboard usability gating, default-colors scanning, and forced-colors scanning with color-contrast disabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PlaywrightTest
  participant Dashboard
  participant AxeBuilder
  participant TestInfo
  PlaywrightTest->>Dashboard: verify dashboard is usable
  PlaywrightTest->>AxeBuilder: run WCAG scan
  AxeBuilder-->>PlaywrightTest: return violations
  PlaywrightTest->>TestInfo: attach JSON results
  PlaywrightTest->>PlaywrightTest: fail on serious or critical violations

Loading

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: adding axe-core WCAG scans to the accessibility suite.
Description check	✅ Passed	The description covers Summary, Verification, Notes, and an applicable governance note, with concrete test results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Generated And Sensitive Files	✅ Passed	PR only updates package.json, package-lock.json, and a test file; no secrets, env files, logs, caches, or build artifacts were committed.
Verification Claims	✅ Passed	Verification claims name exact commands and results: npm run test:e2e:accessibility, npm run verify:cheap, and npm run format.
Risky Git Or Deployment Actions	✅ Passed	PASS: The PR only adds a dev dependency and accessibility tests; no new force-push/reset/branch-deletion/deployment instructions, scripts, or workflows were added.
Supabase Project And Schema Safety	✅ Passed	Only package.json, package-lock.json, and tests/ui-accessibility.spec.ts changed; diff adds axe tooling and UI accessibility tests, with no Supabase project, schema, RLS, or migration edits.
Runtime And Package Manager Integrity	✅ Passed	packageManager stays npm@11.17.0, engines stay Node 24/npm 11, engine-strict is unchanged, and the commit only adds @axe-core/playwright plus lockfile entries.
Api Route Failure Handling	✅ Passed	PR only changes a Playwright accessibility test and adds a devDependency; no API route, server action, RAG, search, ingestion, or provider code was modified.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/axe-a11y-scan

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/axe-a11y-scan

---

_{Comment @coderabbitai help to get the list of available commands.}