feat(kargo): Accounts sign-in freight-verification AnalysisTemplate (tb-dev) [DRAFT]

[aatchison]

Draft. Adds the Kargo freight-verification AnalysisTemplate for Accounts on tb-dev. Two REPLACE_* sentinels remain (Kargo Project namespace + CI-built E2E image); see below.

What

A Kargo AnalysisTemplate (accounts-signin-e2e) that runs the new @deployment-analysis Playwright sign-in E2E from thunderbird-accounts#1146 (npm run deployment-analysis-e2e) as freight verification on tb-dev — plus the ExternalSecret for the test-user creds and a kargo/README.md.

kargo/
  tb-dev/
    analysistemplate-accounts-signin.yaml
    externalsecret-e2e-creds.yaml
    kustomization.yaml
  README.md

Wires into the Accounts Kargo Stage as:

spec:
  verification:
    analysisTemplates:
      - name: accounts-signin-e2e

The env var (the point of this PR)

ACCTS_TARGET_ENV=dev is set deliberately. On dev the test user has no Pro subscription (subscribe isn't automated yet), so the suite's dev guard skips the subscription-detail dashboard assertions while still exercising OIDC sign-in via the test's beforeEach. With any other value the test hard-fails: navigateToDashboard() polls for /dashboard, but a subscription-less user is redirected to /subscribe. ACCTS_HUB_URL is the public host (accounts.tb-dev.thunderbird.dev) because sign-in bounces through the public Keycloak.

Before deploy-ready (why it's a draft)

• REPLACE_KARGO_PROJECT_NS — the Accounts Kargo Project namespace (from the sibling Project/Warehouse/Stage spec, not yet in this repo).
• REPLACE_E2E_IMAGE — a Playwright image bundling test/e2e + browsers + the deployment-analysis-e2e script, built by Accounts CI (thunderbird-accounts#1137).
• Secrets Manager — create mzla/tb-dev/accounts-e2e (ACCTS_OIDC_EMAIL + ACCTS_OIDC_PWORD) and ensure the Kargo cluster has the aws-secrets-manager ClusterSecretStore + IRSA read access.

kubectl kustomize kargo/tb-dev renders both manifests cleanly.

[aatchison]

Verified against merged upstream + reworked to approach (b)

Now that thunderbird-accounts#1146 is merged, I verified this against reality:

• ✅ Contract matches — deployment-analysis-e2e script, @deployment-analysis tag, and ACCTS_TARGET_ENV (upstream now defaults it to dev, so our explicit dev stays correct).
• ✅ Kargo is live — project tb-accounts, stage tb-dev; namespace filled in (was REPLACE_KARGO_PROJECT_NS).
• ✅ Manifests valid — kubectl apply --dry-run=server accepts both the AnalysisTemplate and the ExternalSecret against tb-accounts.

Key finding that changed the design: there is no published E2E image — upstream runs Playwright directly on a GitHub runner (validate.yml run-e2e-tests-local), and there's no test/e2e Dockerfile/CI build. So the original REPLACE_E2E_IMAGE approach couldn't run. Reworked to approach (b): a stock mcr.microsoft.com/playwright:v1.59.1-noble image (tag pinned to the repo's @playwright/test) checks out test/e2e at run time (git clone → npm ci → npx playwright install firefox → npm run deployment-analysis-e2e). Public repo → no clone creds; ACCTS_E2E_REF (default main) selects the ref.

Approach (c) noted for later (in the template + README): have Kargo trigger the existing GH Actions E2E workflow via a web/webhook provider instead of running Playwright in-cluster — reuses CI's runner + secrets, no in-cluster browser/egress.

Still needed before it can run live (kept as a draft):

1. Secrets Manager mzla/tb-dev/accounts-e2e (ACCTS_OIDC_EMAIL + ACCTS_OIDC_PWORD) for a tb-dev test user, + ClusterSecretStore/IRSA read access on the AnalysisRun cluster.
2. Wire the tb-accounts/tb-dev Stage spec.verification.analysisTemplates → accounts-signin-e2e (currently empty).
3. Job egress to GitHub/npm + accounts.tb-dev / auth.tb-dev (all public).