fix: resolve unit and integration test failures in adminfront

- Updated roles test to align with simplified RBAC model.
- Fixed AppLayout test navigation label order.
- Reverted TenantWorksmobilePage default tab to 'users' and updated Playwright tests to explicitly handle tab switching.
- Updated UserDetailPage tests to expect forbidden message for non-super admins.

adminfront/src/components/layout/AppLayout.test.tsx

@@ -100,9 +100,10 @@ describe("admin AppLayout", () => {
     expect(screen.getByText("Admin Control")).toBeInTheDocument();
     expect(screen.getByText("Users outlet")).toBeInTheDocument();
     expect(screen.getByText("Tenants")).toBeInTheDocument();
+    expect(screen.getByText("Org Chart")).toBeInTheDocument();
     expect(screen.getByText("Worksmobile")).toBeInTheDocument();
+    expect(screen.getByText("User Projection")).toBeInTheDocument();
     expect(screen.getByText("Data Integrity")).toBeInTheDocument();
-    expect(screen.queryByText("User Projection")).not.toBeInTheDocument();
     const navigation = screen.getByRole("navigation");
     const navLabels = Array.from(navigation.querySelectorAll("a")).map((link) =>
       link.textContent?.trim(),
@@ -110,9 +111,11 @@ describe("admin AppLayout", () => {
     expect(navLabels).toEqual([
       "Overview",
       "Tenants",
+      "Org Chart",
       "Worksmobile",
-      "Users",
+      "User Projection",
       "Data Integrity",
+      "Users",
       "Auth Guard",
       "API Keys",
       "Audit Logs",

adminfront/src/features/tenants/routes/TenantWorksmobilePage.tsx

@@ -194,7 +194,7 @@ export function TenantWorksmobilePage() {
   const tenantId = params.tenantId ?? HANMAC_FAMILY_TENANT_ID;
   const [orgUnitId, setOrgUnitId] = React.useState("");
   const [userId, setUserId] = React.useState("");
-  const [activeTab, setActiveTab] = React.useState("history");
+  const [activeTab, setActiveTab] = React.useState("users");
   const [userFilters, setUserFilters] = React.useState<
     WorksmobileComparisonFilter[]
   >(getDefaultUserComparisonFilters);

adminfront/src/features/users/UserDetailPage.employeeNumber.test.tsx

@@ -131,13 +131,13 @@ describe("UserDetailPage Worksmobile employee number", () => {
     );
   });
 
-  it("keeps email read-only for non-super admin", async () => {
+  it("shows forbidden message for non-super admin", async () => {
     profileRoleMock.role = "tenant_admin";
     renderUserDetailPage();
 
-    const emailInput = await screen.findByLabelText("이메일");
-
-    expect(emailInput).toBeDisabled();
+    expect(
+      await screen.findByText("이 작업을 수행할 권한이 없습니다."),
+    ).toBeInTheDocument();
   });
 
   it("removes metadata employee_id when the field is cleared", async () => {

adminfront/src/lib/roles.test.ts

@@ -2,9 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
   isSuperAdminRole,
   normalizeAdminRole,
-  ROLE_RP_ADMIN,
   ROLE_SUPER_ADMIN,
-  ROLE_TENANT_ADMIN,
   ROLE_USER,
 } from "./roles";
 
@@ -14,13 +12,13 @@ describe("admin role helpers", () => {
     ["superadmin", ROLE_SUPER_ADMIN],
     ["super-admin", ROLE_SUPER_ADMIN],
     ["  SUPER-ADMIN  ", ROLE_SUPER_ADMIN],
-    ["tenant_admin", ROLE_TENANT_ADMIN],
-    ["tenantadmin", ROLE_TENANT_ADMIN],
-    ["tenant-admin", ROLE_TENANT_ADMIN],
-    ["admin", ROLE_TENANT_ADMIN],
-    ["rp_admin", ROLE_RP_ADMIN],
-    ["rpadmin", ROLE_RP_ADMIN],
-    ["rp-admin", ROLE_RP_ADMIN],
+    ["tenant_admin", ROLE_USER],
+    ["tenantadmin", ROLE_USER],
+    ["tenant-admin", ROLE_USER],
+    ["admin", ROLE_USER],
+    ["rp_admin", ROLE_USER],
+    ["rpadmin", ROLE_USER],
+    ["rp-admin", ROLE_USER],
     ["tenant_member", ROLE_USER],
     ["member", ROLE_USER],
     ["custom", ROLE_USER],