M24: implement privacy governance

frontend/e2e/interactive-elements.spec.ts

@@ -25,7 +25,7 @@ test.beforeEach(async ({ page, request }) => {
   await expect(page).toHaveURL(/\/dashboard$/);
 });
 
-test("all seven nav items navigate correctly", async ({ page }) => {
+test("all manager navigation items navigate correctly", async ({ page }) => {
   const items: [string, RegExp][] = [
     ["Overview", /\/dashboard$/],
     ["Fleet", /\/vehicles$/],
@@ -34,6 +34,8 @@ test("all seven nav items navigate correctly", async ({ page }) => {
     ["Knowledge", /\/knowledge$/],
     ["Integrations", /\/automation$/],
     ["Audit trail", /\/audit$/],
+    ["Users", /\/users$/],
+    ["Privacy", /\/privacy$/],
   ];
   const primaryNavigation = page.getByRole("navigation", { name: "Primary navigation" });
   for (const [label, urlPattern] of items) {
@@ -378,6 +380,7 @@ test("rental employee role has a restricted nav and cannot reach manager-only pa
   await expect(page.getByRole("link", { name: "Data quality" })).toHaveCount(0);
   await expect(page.getByRole("link", { name: "Integrations" })).toHaveCount(0);
   await expect(page.getByRole("link", { name: "Audit trail" })).toHaveCount(0);
+  await expect(page.getByRole("link", { name: "Privacy" })).toHaveCount(0);
 
   // Direct URL navigation is still blocked server-side and shows the same restricted
   // message as a defense-in-depth measure, not just a hidden button.
@@ -394,6 +397,9 @@ test("rental employee role has a restricted nav and cannot reach manager-only pa
   await page.goto("/audit");
   await expect(page.getByText("Audit history is visible to Operations Managers only.").first()).toBeVisible();
 
+  await page.goto("/privacy");
+  await expect(page.getByText("These governance functions are available to Operations Managers only.")).toBeVisible();
+
   await expect(page.getByRole("button", { name: "Reset demo data" })).toHaveCount(0);
 });