Add RBAC integration spec: user + group creation, ACL membership

[tomchop]

Summary

• New spec covering a feature area with zero prior coverage: users, groups, and ACLEdit. Creates a user and a group through the admin UI (/system/users, /system/groups), grants the user a Writer role on the group via ACLEdit's identity-select + role-select + "Update memberships" flow, and confirms it both in the UI and via a direct API check of the persisted ACL edge.
• This exercises the exact code path behind the already-known Permission IntFlag schema mismatch (services/rbac.ts/services/users.ts widen the generated 1 | 2 | 4 type back to number to send composite role values like 3/7) -- the spec asserts the persisted role is exactly 3 (Writer), so a regression there would be caught.
• README gains three new documented gotchas found while building this (all in Vuetify's overlay/select behavior, not app bugs):
  • getByLabel(X) can fuzzy-match a field's own append-icon aria-label ("X appended action") as well as the field itself
  • a v-combobox/v-select dropdown teleports outside its logical DOM container, same as the nested-dialog gotcha already documented -- query role="option" unscoped
  • a multi-select combobox's dropdown doesn't auto-close after picking one option, and can sit on top of what's below it until dismissed

Test plan

• Spec run individually 4x in a row against a live dev stack -- all green
• Full suite (14 specs) run together -- all green
• npx tsc --noEmit on the playwright package -- clean
• No leftover test data (verified via direct API search post-run)