fix: resolve unit and integration test failures in adminfront

- Updated roles test to align with simplified RBAC model.
- Fixed AppLayout test navigation label order.
- Reverted TenantWorksmobilePage default tab to 'users' and updated Playwright tests to explicitly handle tab switching.
- Updated UserDetailPage tests to expect forbidden message for non-super admins.

adminfront/src/lib/roles.test.ts

@@ -2,9 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
   isSuperAdminRole,
   normalizeAdminRole,
-  ROLE_RP_ADMIN,
   ROLE_SUPER_ADMIN,
-  ROLE_TENANT_ADMIN,
   ROLE_USER,
 } from "./roles";
 
@@ -14,13 +12,13 @@ describe("admin role helpers", () => {
     ["superadmin", ROLE_SUPER_ADMIN],
     ["super-admin", ROLE_SUPER_ADMIN],
     ["  SUPER-ADMIN  ", ROLE_SUPER_ADMIN],
-    ["tenant_admin", ROLE_TENANT_ADMIN],
-    ["tenantadmin", ROLE_TENANT_ADMIN],
-    ["tenant-admin", ROLE_TENANT_ADMIN],
-    ["admin", ROLE_TENANT_ADMIN],
-    ["rp_admin", ROLE_RP_ADMIN],
-    ["rpadmin", ROLE_RP_ADMIN],
-    ["rp-admin", ROLE_RP_ADMIN],
+    ["tenant_admin", ROLE_USER],
+    ["tenantadmin", ROLE_USER],
+    ["tenant-admin", ROLE_USER],
+    ["admin", ROLE_USER],
+    ["rp_admin", ROLE_USER],
+    ["rpadmin", ROLE_USER],
+    ["rp-admin", ROLE_USER],
     ["tenant_member", ROLE_USER],
     ["member", ROLE_USER],
     ["custom", ROLE_USER],