Fix global.setup.ts: tolerate post-login redirect away from wp-admin

The previous setup asserted that the URL after submitting wp-login.php
matches /wp-admin/. On staging.peptiderepo.com, a login_redirect filter
sends successful admin logins to the site homepage instead of wp-admin,
so this assertion failed even on correct credentials — the setup logged
in, the storage state would have been usable, but Playwright treated it
as a credential failure and the storage state was never written.

Replaces the post-submit assertion with two safer checks:
- Wait until URL is no longer wp-login.php (i.e. login was accepted)
- Navigate explicitly to /wp-admin/ and assert we land there with the
  admin bar visible

This bug was hidden behind the testDir misalignment (fixed in #1) and
the stale staging admin username GH Secret (rotated 2026-05-14). With
both of those fixed, the third bug surfaced.

Agent-Session: cto peptide-e2e-post-login-redirect-fix

global.setup.ts

@@ -33,8 +33,18 @@ setup('authenticate as WP admin', async ({ page }) => {
   await page.fill('#user_pass', password);
   await page.click('#wp-submit');
 
-  // Wait for successful redirect to wp-admin dashboard
-  await expect(page).toHaveURL(/wp-admin/, { timeout: 20_000 });
+  // Wait for any post-login navigation. The site may redirect successful logins
+  // to the homepage (via a login_redirect filter) rather than to wp-admin —
+  // staging does this. So we don't assert the post-submit URL; instead, we
+  // verify we're no longer ON wp-login.php (which would indicate a credential
+  // rejection or 2FA prompt) and then navigate explicitly to wp-admin.
+  await page.waitForURL((url) => !url.pathname.includes('/wp-login.php'), {
+    timeout: 20_000,
+  });
+
+  // Navigate explicitly into wp-admin to capture the authenticated admin session.
+  await page.goto('/wp-admin/');
+  await expect(page).toHaveURL(/\/wp-admin\//, { timeout: 20_000 });
   await expect(page.locator('#wpadminbar')).toBeVisible();
 
   // Persist session cookies + localStorage to disk