test: CV and cover-letter rendering, model evaluation, frontend smoke tests

[coderback]

Summary

This fills three testing gaps: CV and cover-letter rendering, the LLM's reading of job ads, and the frontend.

1. CV and cover-letter rendering (api/tests/test_documents.py)

A graduate profile shaped like a real one goes through the tailoring tool, the HTML template and WeasyPrint. The 24 new tests check:

• section order (education first for graduates) and clickable contact and project links;
• cleaned-up portfolio prose, a summary without pronouns, and HTML escaping;
• every length limit;
• what the model may not change (contact details, skills, project links);
• the cover letter's sign-off and paragraphs;
• page counts in the template's font, the fpdf2 fallback, and the PDF endpoints.

Coverage of doc_render goes from 53% to 94%, and pdf_generator from 55% to 92%. CI's API job now installs Pango and the Liberation fonts, so the PDF tests run there with production's font. They skip only where WeasyPrint can't load (Windows), and never in CI.

Two known gaps are strict xfails, to be fixed next:

• skill groups after the sixth are dropped (_MAX_SKILL_GROUPS);
• a graduate CV with everything the prompt allows runs about a fifth of a page onto page 2.

2. Model evaluation (api/evals/)

This is opt-in: it only runs with WINDRUSH_LLM_EVAL=1, because it calls the real LLM about 500 times. It scores job_attributes.extract on:

• a blind 523-item seniority set: hand-written titles and ads, labelled junior / mid / senior;
• the labelled sponsorship sentences from the regex tests.

The pass marks sit under the first three runs (seniority 96.4%, 96.0% and 95.7%):

• seniority ≥ 94%;
• each level's recall ≥ 90%;
• at most one junior role read as senior;
• sponsorship ≥ 90%;
• at most 1% failed calls.

It lives outside tests/, so the fake-LLM environment there never applies. Each run writes evals/last_run.json (gitignored).

3. Frontend smoke tests (frontend/e2e/)

Six Playwright tests drive the production build in Chromium, with every /api call mocked in the browser. An unmocked call fails the test. They cover:

• the signed-out redirect, logging in, a wrong password, and an expired session;
• the job feed: each card's badges, plus the experience, degree and clear-filter controls reaching /api/jobs;
• the Profile page saving comma-typed titles and locations as lists.

CI's frontend job runs them after the build and uploads traces on failure. @playwright/test is pinned at 1.63.0.

Testing

• API suite: 631 passed, 1 xfailed, 4 skipped (the WeasyPrint tests, on Windows). In the API image, all document tests pass (24 passed, 2 xfailed).
• The model evaluation passed against Azure: seniority 95.7% (regex 88.3%), sponsorship 28 of 29.
• The smoke tests pass, and they caught both bugs they were checked against: the old CommaListInput re-join and a dropped max_years parameter.