#22: fix the admin lockout, and the regressions the UI rewrite brought back

The console demanded a second factor and refused to open without one, but
enrolment lived on the other surface - so an operator whose only account
was the administrator had no way in. The password was already verified at
that point, so the refusal now carries a short-lived grant that permits
enrolling a factor and nothing else, and the admin login screen walks
through it: secret, confirmation, recovery codes, sign in. Two tests cover
it, including that the grant opens no other endpoint.

The rewrite also undid work that was already in place:

  - The postcss override was dropped and the advisory came back, along
    with a critical one in vitest. postcss is a direct dependency now, so
    the fix is the version plus an override scoped to Next's own copy;
    vitest moves to 3.2.7. The lockfile needed regenerating for either to
    take effect. Zero advisories now.

  - 100 language-lint violations: the admin console had been rewritten
    with its strings in Portuguese, hardcoded. That fails CI, and it also
    puts those strings beyond the reach of the translation bundles - an
    English or Spanish user would have read Portuguese. They are English
    in the source again.

  - The mail screen put a fixed 320px list beside the reader with no
    breakpoint, so on a phone the viewport overflowed and the message was
    a few pixels wide. One pane at a time below md, with a way back.

  - The icon-only navigation toggles had nothing for a screen reader to
    announce.

The layouts' own mobile navigation and every previously fixed behaviour
survived the rewrite - checked rather than assumed.

Also fixes a marker collision I introduced: the E2E helper locates the
repository by a migrations directory, and services/migrations satisfied
that one directory too early. It now requires the SQL to actually be
there.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/e2e/smtp_inbound_e2e_test.go

@@ -270,17 +270,20 @@ func repoRoot(t *testing.T) string {
 	if err != nil {
 		t.Fatal(err)
 	}
-	// The marker is the migrations directory, which is what every caller is
-	// ultimately after. It used to be PLAN.md - a file .gitignore excludes on
-	// purpose ("never published with the code"), so it does not exist in a
-	// fresh checkout and this helper could never succeed in CI. That failure
-	// took the entire E2E suite down on every run.
+	// The marker is a migrations directory that actually holds migrations.
+	//
+	// It used to be PLAN.md, which .gitignore excludes on purpose, so this
+	// could never succeed in CI. Matching a bare "migrations" directory was
+	// the next attempt and broke as soon as services/migrations appeared -
+	// walking up from a test hits that one first and stops at services/.
+	// Requiring the SQL to be there is what the callers actually need.
 	for i := 0; i < 8; i++ {
-		if info, err := os.Stat(filepath.Join(dir, "migrations")); err == nil && info.IsDir() {
+		matches, _ := filepath.Glob(filepath.Join(dir, "migrations", "*.up.sql"))
+		if len(matches) > 0 {
 			return dir
 		}
 		dir = filepath.Dir(dir)
 	}
-	t.Fatal("could not locate repository root (no migrations directory in any parent)")
+	t.Fatal("could not locate repository root (no migrations/*.up.sql in any parent)")
 	return ""
 }