docs: record Vaultwarden credential backup completion

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -87,8 +87,9 @@ One login instead of logging into Proxmox, Zabbix, OMV, and every service separa
 - **Authentik redirect URIs**: both the public (`https://monitor.jerodrigged.com/...`, now primary in
   `.env`) and LAN (`http://192.168.1.103:8090/...`) callback URLs are registered in the blueprint, so
   OIDC login still works if the tunnel/DNS is ever down.
-- **Vaultwarden**: dashboard admin credentials saved as "Homelab Monitor (dashboard admin)". OIDC client
-  credentials not yet saved there (pending a `BW_SESSION` from the user).
+- **Vaultwarden**: three items saved — "Homelab Monitor (dashboard admin)" (local admin login),
+  "Homelab Monitor - Authentik OIDC client (homelab-monitor provider)" (client_id/secret, secure note),
+  and "Homelab Monitor - Authentik test account (playwright-test)" (the e2e test account's login).
 
 ## Zabbix: intentionally skipped, not blocked
 
@@ -108,11 +109,13 @@ skipped). `GET .../issues?state=open` on this repo should return empty. First re
 both above), fixed, and now covered by `e2e/oidc-login.spec.ts` as regression coverage. Both local and
 OIDC login are Playwright-verified passing (5 consecutive runs) as of this writing.
 
+e2e coverage expanded beyond the happy path (invalid credentials, session persistence, unauthenticated
+API rejection) — 9 tests, stable across repeated full-suite runs with parallel workers. All credentials
+this project generated are now in Vaultwarden.
+
 If picking this up again with no specific ask from the user, there's no queued work — check in with them
 for what's next rather than inventing scope. Remaining known gaps, none blocking:
 
-- OIDC client credentials aren't in Vaultwarden yet (Proxmox token and admin password are) — needs a
-  `BW_SESSION` from the user.
 - `diskPaths` in `hosts.yaml` vs. the remote forced-command scripts on omv/ripper is a manual-sync point
   (documented, not automated — only 2 hosts, hasn't been worth it).
 - `e2e/` isn't wired into CI — run by hand (`cd e2e && npm test`) after any auth-related change.