Enable Sprint D e2e: API-seeded admin session, un-skip vitals/scroll.

Admin review smoke seeds localStorage from FastAPI login instead of the
login form — fixes CI flakes on the shared runner.

e2e/tests/admin.review-pages.spec.ts

@@ -1,28 +1,50 @@
+import { z } from 'zod';
 import { test, expect } from '../fixtures';
-import { AdminLoginPage } from '../pages/AdminLoginPage';
 import { BUDGET_MS, expectWithinBudget } from '../timing-budgets';
 import { DEFAULT_ADMIN_BASE_URL } from '../env-defaults';
 
+const TokenResponse = z.object({
+  access_token: z.string().min(1),
+  refresh_token: z.string().min(1),
+});
+
 /**
  * FastAPI-admin UI smoke: core review workflows load without error.
  * Uses E2E_API_USERNAME/PASSWORD (admin FastAPI user — not NextAuth viewer creds).
  */
-test.describe.skip('admin review pages @smoke', () => {
+test.describe('admin review pages @smoke', () => {
   const adminBaseUrl = process.env.PLAYKIT_ADMIN_BASE_URL || DEFAULT_ADMIN_BASE_URL;
 
   test('identify, auto-match, and approve pages load for admin', async ({
     page,
+    api,
     timings,
   }) => {
     const username = process.env.E2E_API_USERNAME || '';
     const password = process.env.E2E_API_PASSWORD || '';
     test.skip(!username || !password, 'E2E_API_USERNAME/PASSWORD required for admin UI');
 
-    const login = new AdminLoginPage(page, adminBaseUrl);
-
     await timings.measure('admin_login', async () => {
-      await login.openLogin();
-      await login.signIn(username, password);
+      const tokens = await api.post<z.infer<typeof TokenResponse>>('/api/v1/auth/login', {
+        body: { username, password },
+        expectedStatus: 200,
+        schema: TokenResponse,
+      });
+
+      // Seed the admin SPA session (same keys as AuthContext) — more reliable than
+      // driving the login form on the shared CI runner.
+      await page.goto(`${adminBaseUrl}/login`);
+      await page.evaluate(
+        ({ access, refresh }) => {
+          localStorage.setItem('access_token', access);
+          localStorage.setItem('refresh_token', refresh);
+        },
+        {
+          access: tokens.data.access_token,
+          refresh: tokens.data.refresh_token,
+        },
+      );
+      await page.goto(`${adminBaseUrl}/`);
       await expect(page.getByRole('button', { name: 'Logout' })).toBeVisible({
         timeout: 30_000,
       });