test(e2e): add TC-E2E-003/004/005/007/008/009/010 — delete, pagination, errors, profile, theme

- test_post_deletion.py: user delete own, admin delete any, 403 for other's
- test_pagination.py: navigation across pages, boundary on last page
- test_errors.py: 404 nonexistent post, 404 for other user's draft
- test_post_lifecycle.py: draft-to-publish via edit flow
- test_post_ownership.py: user can edit own post
- test_profile_and_theme.py: profile page rendering, theme toggle with localStorage
- fix(web): remove infinite pagination for USER role (routes.py)
- fix(e2e): stabilize all publish() calls with expect_navigation
- fix(e2e): add _unique_title() to avoid slug collisions at scale
- docs: update FEATURE_POST_LIFECYCLE.md and TEST_MODEL.md coverage

tests/e2e/test_errors.py

@@ -0,0 +1,111 @@
+"""End-to-end tests for error page handling in the web UI.
+
+Tests that the blog renders appropriate error pages with correct status codes
+and contextual elements for common error scenarios.
+"""
+
+from __future__ import annotations
+
+import uuid
+
+import pytest
+from playwright.sync_api import Page
+
+from tests.e2e.pages import HomePage, PostDetailPage, PostFormPage
+
+
+def _unique_title(base: str) -> str:
+    """Append a short UUID to a title to avoid slug collisions."""
+    return f"{base} {uuid.uuid4().hex[:8]}"
+
+
+@pytest.mark.e2e
+def test_nonexistent_post_returns_404(
+    guest_page: Page,
+    user_page: Page,
+    base_url: str,
+) -> None:
+    """Test that accessing a nonexistent post slug returns a 404 error page.
+
+    Steps:
+        1. Generate a random slug that does not exist.
+        2. Navigate to the detail page as a guest.
+        3. Verify the error page shows code 404.
+        4. Repeat as an authenticated user.
+
+    Args:
+        guest_page: Unauthenticated Playwright page.
+        user_page: Playwright page authenticated as regular user.
+        base_url: Application base URL.
+    """
+    fake_slug = f"nonexistent-{uuid.uuid4().hex[:8]}"
+
+    detail = PostDetailPage(guest_page, base_url, fake_slug)
+    detail.open()
+    guest_page.wait_for_selector('[data-testid="error-code"]')
+    error_code = guest_page.locator('[data-testid="error-code"]').text_content()
+    assert error_code == "404"
+
+    detail_user = PostDetailPage(user_page, base_url, fake_slug)
+    detail_user.open()
+    user_page.wait_for_selector('[data-testid="error-code"]')
+    error_code_user = user_page.locator('[data-testid="error-code"]').text_content()
+    assert error_code_user == "404"
+
+
+@pytest.mark.e2e
+def test_other_user_draft_returns_404(
+    user_page: Page,
+    user2_page: Page,
+    guest_page: Page,
+    base_url: str,
+) -> None:
+    """Test that a draft post returns 404 to anyone except the owner and admin.
+
+    Steps:
+        1. User creates a draft post and saves it.
+        2. Extract the slug from the detail page URL.
+        3. User2 navigates to the draft slug and verifies 404.
+        4. Guest navigates to the draft slug and verifies 404.
+        5. Owner (user) navigates to the same slug and verifies 200 with Draft badge.
+
+    Args:
+        user_page: Playwright page authenticated as the draft owner.
+        user2_page: Playwright page authenticated as another regular user.
+        guest_page: Unauthenticated Playwright page.
+        base_url: Application base URL.
+    """
+    from pytfm.generators import PostDataGenerator
+
+    generator = PostDataGenerator()
+    post_data = generator.generate_post()
+    title = _unique_title(str(post_data["title"]))
+    content = str(post_data["content"])
+    tags = ", ".join(post_data["tags"])
+
+    home = HomePage(user_page, base_url)
+    home.open()
+    home.create_post()
+
+    form = PostFormPage(user_page, base_url)
+    form.fill_form(title, content, tags)
+    with user_page.expect_navigation(wait_until="networkidle"):
+        form.save_draft()
+    draft_url = user_page.url
+    assert "new" not in draft_url, f"Still on form page: {draft_url}"
+    slug = draft_url.rstrip("/").split("/")[-1]
+
+    user_page.wait_for_selector('[data-testid="post-detail-title"]')
+    owner_detail = PostDetailPage(user_page, base_url, slug)
+    assert owner_detail.get_title() == title
+    assert owner_detail.get_status() == "Draft"
+
+    user2_detail = PostDetailPage(user2_page, base_url, slug)
+    user2_detail.open()
+    user2_page.wait_for_selector('[data-testid="error-code"]')
+    assert user2_page.locator('[data-testid="error-code"]').text_content() == "404"
+
+    guest_detail = PostDetailPage(guest_page, base_url, slug)
+    guest_detail.open()
+    guest_page.wait_for_selector('[data-testid="error-code"]')
+    assert guest_page.locator('[data-testid="error-code"]').text_content() == "404"