test(e2e): sprint 5 acceptance tests — US-26 → US-28 + dropdown adaptations

Add three new spec files:
- us26-templates-crud: API CRUD (AC-26.3–26.7) + UI list/form/delete/redirect (AC-26.8)
- us27-instantiate-from-template: template_id copy + name override + 404 + decoupling
  (AC-27.1–27.3) + no auto-transition/engagement-activate (AC-27.4–27.5) + dropdown
  UI + picker modal + empty state + SOC gate (AC-27.6–27.7)
- us28-templates-nav: Templates link admin+redteam only, SOC redirect, form editable (AC-28.1–28.3)

Adapt sprint 2/3 e2e for sprint 5 dropdown:
- us4-engagements: getByRole link "New simulation" → getByTestId "new-simulation-btn"
- us7-simulation-create: same — split-button dropdown replaced the link

Suite: 201 passed (1 pre-existing flaky in us3 re DB state, unrelated to sprint 5).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

e2e/tests/us4-engagements.spec.ts

@@ -265,9 +265,7 @@ test.describe('US-4 — engagement CRUD', () => {
     await expect(page.getByRole('heading', { name: /AC-4.9 detail target/i })).toBeVisible();
     // Sprint 2 replaced the placeholder with the real SimulationList — covered by AC-7.5.
     await expect(page.getByRole('heading', { name: /simulations/i })).toBeVisible();
-    // admin/redteam see the "New simulation" button
-    await expect(
-      page.getByRole('link', { name: /new simulation/i }),
-    ).toBeVisible();
+    // Sprint 5: "New" is now a split-button dropdown (data-testid="new-simulation-btn")
+    await expect(page.getByTestId('new-simulation-btn')).toBeVisible();
   });
 });