feat(#288): post-deploy @smoke suite + fix(#348) the CSS-as-script bug it caught

[TortoiseWolfe]

What

#288, item 2 — the post-deploy production smoke suite: the missing verification that the deployed product works. #287 proved the whole suite can be green while prod is unusable. This runs against the live origin after each deploy (+ daily) and asserts the thing a customer touches — and on its very first run it caught a real production bug, which this PR also fixes.

Refs #288 (item 2). Closes #348.

It caught a real prod defect — and we fixed it (not muted it)

Run against live scripthammer.com, the "sign-in loads with zero console errors" check went red on a genuine defect: the exported HTML emits the same stylesheet twice — correctly as <link rel="stylesheet"> and wrongly as <script src="/_next/static/css/….css" async>. The browser fetches the CSS as a script → SyntaxError: Invalid or unexpected token, partially breaking the client on every page. The sloppy-mode check-chunks-parse.mjs gate never saw it (it only parses JS chunks), so it shipped green — the exact #287/#288 class.

This is a known Next.js 15 App-Router static-export bug. Fix (#348): scripts/strip-css-script-tags.mjs, wired into pnpm build after next build, strips the bogus <script src="*.css"> from every exported HTML file (the <link> stays, styling unaffected). Idempotent + logs the count, so a future Next upgrade that fixes it upstream shows 0 and the script can retire.

No test was skipped or allowlisted — the console-error check gates, and it passes because prod is actually fixed.

The smoke checks (all gating)

Check	Method
Providers enabled	GET /auth/v1/settings → external.{github,google,email}
OAuth client_id validity (#287 detector)	GET /auth/v1/authorize?provider=… maxRedirects:0 → assertValidOAuthClientId(Location)
Sign-in zero console errors	console/pageerror collector on /sign-in — caught #348
Canonical origin	BASE_URL serves 200 + github.io 301s → custom domain

Structure

• tests/e2e/smoke/production.smoke.spec.ts + playwright.smoke.config.ts — dedicated config (no globalSetup, no webServer); excluded from the main config's projects.
• tests/e2e/utils/oauth-validity.ts — extracted assertValidOAuthClientId (was module-private in oauth-csrf.spec.ts) — one source of truth for the Production OAuth broken since the Supabase project migration: client IDs are placeholders (recurrence of #85, closed-but-never-fixed) #287 regexes.
• .github/workflows/smoke.yml — triggers: workflow_run after "Deploy to GitHub Pages" (success-guarded) + daily cron + workflow_dispatch. No pull_request — a post-deploy monitor tests the deployed site, so it can't gate a PR (the PR's fix isn't live yet); it runs after this deploys, against the fixed site.
• scripts/strip-css-script-tags.mjs + package.json build — the prod /sign-in throws 'Invalid or unexpected token' — browser-only JS parse error (client-partial-dead, #294 SWC-octal class) #348 fix.

Verified

• Strip regex on the real prod HTML: removes the 1 bad <script src=css>, keeps all 3 <link>s.
• Fresh build (out/) has 0 <script src="*.css"> after the strip; the strip logs the removed count.
• Smoke against live prod: 4/4 gating checks green (the console check now passes once this deploys). type-check + lint clean.

Note for the owner

Canonical: public/CNAME=www but live traffic resolves to apex (github.io 301s → scripthammer.com, apex serves 200). Works, but the CNAME/config mismatch is worth a glance.

🤖 Generated with Claude Code