test(a11y): establish WCAG 2.2 AA baseline

[SHAURYAKSHARMA24]

Summary

Establishes a deterministic WCAG 2.2 AA automated regression baseline for login, authenticated shell/sidebar, repository list/import, architecture graph, and node-inspector journeys. Known findings remain enabled, are capped by exact target/count, and link to separate issues.

The PR also checks in the audit report and human verification checklist. Human keyboard, zoom/reflow, manual contrast, reduced-motion, and screen-reader results remain explicitly not tested; this merge is the owner's requested administrator-override acceptance of the automated baseline, not a claim of WCAG conformance or full completion of #118.

Linked issue

Part of #118

Roadmap alignment

• Roadmap lane: §25 accessibility/testing contribution lane, supporting §23 W4 evidence-led workflow quality.
• §28 criterion: Workflow replacement. Accessible and regression-tested core journeys are necessary for repeated real use, but this PR does not itself constitute user-validation evidence.
• Accepted evidence: deterministic Chromium/axe coverage for six seeded states, a 22-journey disposable browser suite, issue-linked defect inventory, reproducible instructions, and successful macOS revalidation after rebasing onto current dev.
• Owner decision: the owner explicitly authorized an administrator-override merge in this task while the human evidence remains open. No incomplete check is represented as complete.

What changed

Tests and runner

• Added six real-browser WCAG A/AA state checks using installed axe-core 4.12.1.
• Kept every rule enabled; exact known targets can decrease but new/increased findings fail with actionable output.
• Made the disposable runner choose free loopback ports, support Windows/POSIX virtual environments, create ZIP fixtures with Python, and forward Playwright filters.
• Added npm run test:accessibility; the full prototype gate includes the baseline.
• Rebasing exposed two additional current GitHub-import contrast targets; stable identifiers, the issue-linked ceiling, and report were updated before the suite was rerun.

Documentation

• Added docs/accessibility/WCAG_2_2_AA_BASELINE.md with environment, revision, routes/states, rerun commands, findings, limitations, and an exact human checklist.
• Recorded successful macOS revalidation against current dev.

Product behavior

• No production behavior or visible design changed; only stable test identifiers were added.

Acceptance criteria completed

Issue #118 criterion	Status	Evidence
Automated checks cover login, shell/sidebar, repository list/import, architecture graph, and inspector	Complete	6/6 focused accessibility states in the existing prototype CI path
Checked-in manual keyboard, focus, contrast, zoom/reflow, reduced-motion, and screen-reader report	Incomplete human evidence	Exact checklist is checked in; unavailable results remain not tested
Every confirmed automated violation has a separate scoped issue	Complete	#240, #236, #235, #238, and #237
Graph is non-visually equivalent or the missing contract has a dedicated issue	Complete via follow-up	Complete semantic contract tracked in #239
A new contributor can rerun the audit	Complete	Focused/full commands and cross-platform disposable runner are documented

Testing performed

• npm run test:accessibility — PASS: 6/6 Chromium states.
• npm run test:prototype — PASS: 22/22 Chromium journeys.
• npm --prefix apps/frontend run test — PASS: 36 files, 209 tests.
• npm run lint:frontend — PASS.
• npm run build:frontend — PASS.
• git diff --check — PASS.
• Initial post-rebase accessibility run — FAIL as designed on two newly observed import contrast targets; the exact targets/report were updated and all gates above rerun successfully.

Screenshots

Not applicable — no visible product UI change. Failure screenshots/traces and generated browser reports are ignored and not committed.

Security and data considerations

• Browser tests use a disposable account, temporary SQLite database/storage, generated local fixtures, and dynamically selected loopback ports, then clean up.
• No credentials, repository contents, .env files, tokens, generated reports, browser binaries, auth behavior, owner scoping, API contracts, schemas, migrations, or production data behavior changed.

Dependencies and blocked work

• No new dependency or lockfile change.
• Human accessibility evidence remains outstanding and keeps chore: establish a WCAG 2.2 AA accessibility baseline for the product UI #118 open.
• Follow-ups: bug: login registration link relies on color alone #240, bug: authenticated shell icon controls lack accessible names #236, bug: repository row actions lack accessible names #235, bug: sidebar section label fails WCAG AA contrast #238, bug: GitHub import helper text fails WCAG AA contrast #237, and a11y: provide a complete non-visual architecture graph contract #239.

Scope changes or remaining work

• Human/manual and assistive-technology evidence is intentionally not represented by automated DOM/axe evidence.
• The full non-visual graph representation remains scoped to a11y: provide a complete non-visual architecture graph contract #239.
• This PR uses Part of #118; it must not close chore: establish a WCAG 2.2 AA accessibility baseline for the product UI #118 when merged.

Contributor checklist

• This PR targets dev
• The issue was claimed and owner-acknowledged before merge
• The branch was created from upstream/dev
• The branch was rebased onto the latest upstream/dev
• This PR addresses one clearly scoped baseline task
• Roadmap contribution and the owner-authorized exception are stated without claiming market-fit evidence
• Every acceptance criterion claimed complete is actually complete
• Relevant tests pass
• Documentation reflects current verified behavior and limitations
• No secrets, credentials, local env files, or generated artifacts are included
• No unrelated files were changed
• Closing syntax is intentionally not used because chore: establish a WCAG 2.2 AA accessibility baseline for the product UI #118 remains incomplete
• Dependencies and follow-up work are linked