To-dos

• The generic playwright biber and administrator personas are blocked via PERSONA_BIBER_BLOCKED=true and PERSONA_ADMINISTRATOR_BLOCKED=true in templates/playwright.env.j2 (req 019 Rule 11 explicit opt-out). Bluesky’s social-app is a mobile-first SPA whose logout / account control sits behind a profile menu the auth-surface check cannot reach. The bespoke “OIDC: oauth2-proxy + login-broker drop a Bluesky session into social-app via Keycloak (variant A+)” test and its LDAP-variant counterpart in files/playwright/playwright.spec.js already verify both personas authenticate correctly (BSKY_STORAGE.accessJwt is present after the broker handoff). Once a stable selector for the social-app profile menu lands upstream, drop the opt-outs and let the persona helpers drive the dashboard → app → logout journey end-to-end.