feat: add deployment smoke check

docs/DEPLOYMENT.md

@@ -80,6 +80,17 @@ database schema. If the release included an incompatible schema change, restore
 the matching PostgreSQL backup before starting the previous images. Always
 verify the API and web health checks after a rollback.
 
+Run the post-deploy smoke check against the public endpoints:
+
+```sh
+API_HEALTH_URL=http://localhost:3000/health \
+WEB_BASE_URL=http://localhost:8080 \
+./scripts/smoke-production.sh
+```
+
+The check performs read-only requests against API health, the web health path,
+and public search. It exits nonzero on the first failed request.
+
 ## Health Checks
 
 Production Compose waits for healthy PostgreSQL, Redis, and API services before

scripts/smoke-production.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+set -eu
+
+api_url=${API_HEALTH_URL:-http://localhost:3000/health}
+web_url=${WEB_BASE_URL:-http://localhost:8080}
+search_url=${PUBLIC_SEARCH_URL:-$web_url/api/v1/public/search?query=}
+
+check_url() {
+  url=$1
+  label=$2
+  if ! curl --fail --silent --show-error --max-time 10 "$url" >/dev/null; then
+    printf '%s\n' "${label} health check failed: ${url}" >&2
+    exit 1
+  fi
+  printf '%s\n' "${label} check passed"
+}
+
+check_url "$api_url" 'API'
+check_url "$web_url/health" 'Web'
+check_url "$search_url" 'Public search'

scripts/smoke-production.test.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+mkdir -p "$test_dir/bin"
+printf '%s\n' '#!/bin/sh' 'exit 0' > "$test_dir/bin/curl"
+chmod +x "$test_dir/bin/curl"
+
+PATH="$test_dir/bin:$PATH" API_HEALTH_URL=http://api.test/health WEB_BASE_URL=http://web.test \
+  PUBLIC_SEARCH_URL=http://web.test/api/v1/public/search sh "$script_dir/smoke-production.sh" >/dev/null
+
+printf '%s\n' 'smoke-production tests passed.'