refactor(e2e): route every portal login through one Keycloak helper (refs #161)

`medewerker-login.ts` becomes `keycloak-login.ts`: the three citizen specs
each duplicated the same three-line password login, so a fix to the login path
had to be made four times. They now call `loginBurger`, and both realms share
`submitPassword`.

No behaviour change — all 6 specs green against a live stack.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/e2e/keycloak-login.spec.ts

@@ -0,0 +1,14 @@
+import { expect, test } from '@playwright/test';
+import { OTP_PERIOD_MS, nextUnusedCounter } from './keycloak-login';
+
+// Pure check of the TOTP counter guard in loginMedewerker — no browser, no stack. Keycloak refuses
+// a code it has already accepted (its otpPolicyCodeReusable defaults to false), so two logins as
+// the same medewerker inside one 30-second window must not spend the same counter twice (#132).
+test('a login never spends a TOTP counter this medewerker already used', () => {
+  const now = 3 * OTP_PERIOD_MS + 1_000; // 1 second into counter 3
+
+  expect(nextUnusedCounter(now, -1)).toBe(3); // nothing spent yet → the current counter
+  expect(nextUnusedCounter(now, 3)).toBe(4); // the current counter is spent → the next one
+  expect(nextUnusedCounter(now, 4)).toBe(5); // two logins already in this window → the one after
+  expect(nextUnusedCounter(now + OTP_PERIOD_MS, 3)).toBe(4); // window moved on → current again
+});