E2E on PR * follow-ups

Remaining work:

- [ ] **Rotate leaked dev Keycloak passwords** : `user-test-treetracker-admin-client` and `org-manager` are in git history. Reset them in the `treetracker` realm.
- [ ] **Enable the skipped scenarios** via provisioned accounts + secrets:
- admin: an account with the `greenstand-admin` role → set `BDD_GREENSTAND_ADMIN_USERNAME` / `BDD_GREENSTAND_ADMIN_PASSWORD` secrets.
- organization: an approved-org account; move the hard-coded creds in `features/step-definitions/share-org-via-link.steps.js` to a secret and remove `@skip`.
- [ ] **Add proper video recording** — `wdio-video-reporter@5` (WebdriverIO v8 line;v6 is v9-only), replacing the disabled custom capture in `wdio.conf.js`.
- [ ] **Stop committing `reports/` (~2.7 GB); publish report + video to GitHub Pages via CI.** Repoint Pages to `gh-pages` first so the existing report URL keeps working.
- [ ] **Make the E2E check required** in branch protection once stable — first fix the `paths:` filter so docs-only PRs aren't blocked waiting on a check that never runs.