Add Cypress E2E tests with fixture-based API mocking for UI regression protection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cypress/e2e/login.cy.js

@@ -0,0 +1,71 @@
+import { setupApiIntercepts, loginWithFixtures } from '../support/intercept';
+
+describe('Login Flow', () => {
+  beforeEach(() => {
+    setupApiIntercepts();
+  });
+
+  it('renders the login form', () => {
+    cy.visit('/login');
+    cy.get('h2').should('contain', 'LOGIN');
+    cy.get('#account').should('exist');
+    cy.get('#password').should('exist');
+    cy.get('#login_btn_main_btn').should('be.disabled');
+  });
+
+  it('login button is disabled when fields are empty', () => {
+    cy.visit('/login');
+    cy.get('#login_btn_main_btn').should('be.disabled');
+
+    // Only username filled — still disabled
+    cy.get('#account').type('testuser');
+    cy.get('#login_btn_main_btn').should('be.disabled');
+  });
+
+  it('login button enables when both fields are filled', () => {
+    cy.visit('/login');
+    cy.get('#account').type('testadmin');
+    cy.get('#password').type('password123');
+    cy.get('#login_btn_main_btn').should('not.be.disabled');
+  });
+
+  it('successful login redirects to /files', () => {
+    cy.visit('/login');
+    cy.get('#account').type('testadmin');
+    cy.get('#password').type('password123');
+    cy.get('#login_btn_main_btn').click();
+
+    cy.wait('@postToken');
+    cy.url().should('include', '/files');
+  });
+
+  it('failed login shows error message', () => {
+    // Override the token intercept to return 401
+    cy.intercept('POST', '/api/oauth/token', {
+      statusCode: 401,
+      body: { detail: 'Incorrect username or password' },
+    }).as('postTokenFail');
+
+    cy.visit('/login');
+    cy.get('#account').type('wronguser');
+    cy.get('#password').type('wrongpass');
+    cy.get('#login_btn_main_btn').click();
+
+    cy.wait('@postTokenFail');
+    cy.contains('Incorrect account or password').should('be.visible');
+  });
+
+  it('toggles password visibility', () => {
+    cy.visit('/login');
+    cy.get('#password').type('secret123');
+    cy.get('#password').should('have.attr', 'type', 'password');
+
+    // Click the eye icon to show password
+    cy.get('label[for="passwordt"] span.cursor-pointer').click();
+    cy.get('#password').should('have.attr', 'type', 'text');
+
+    // Click again to hide
+    cy.get('label[for="passwordt"] span.cursor-pointer').click();
+    cy.get('#password').should('have.attr', 'type', 'password');
+  });
+});