feat(qa): add smoke test suite + post-deploy workflow

- e2e/api/smoke.spec.ts — 9 @smoke API tests covering health, auth roundtrip,
  token refresh, listings, search, payments, subscriptions, and inquiries
- e2e/web/smoke.spec.ts — 7 @smoke Web tests covering homepage, login/register
  pages, listings, search, listing detail 404 handling, and console-error check
- playwright.config.ts — smoke-api and smoke-web projects (grep: /@smoke/)
  allowing targeted post-deploy execution without the full suite
- .github/workflows/smoke.yml — workflow_dispatch + workflow_call trigger for
  running only the @smoke subset against staging or production URLs

Co-Authored-By: Paperclip <noreply@paperclip.ing>

e2e/api/smoke.spec.ts

@@ -0,0 +1,123 @@
+/**
+ * Smoke suite — API
+ *
+ * Runs after every deploy to verify core API paths are healthy.
+ * Tests are tagged with @smoke so they can be isolated:
+ *
+ *   npx playwright test --project=api --grep @smoke
+ *
+ * Intentionally lightweight: each test makes at most one API call and
+ * asserts only on status code + structural shape.  No heavy fixtures,
+ * no side effects that require cleanup.
+ */
+import { test, expect } from '@playwright/test';
+import { createTestUser, registerUser } from '../fixtures';
+
+// ── Health ────────────────────────────────────────────────────────────────────
+
+test('@smoke API health check returns 200', async ({ request }) => {
+  // Playwright baseURL ends with /api/v1/ — health is at the root
+  const res = await request.get('../../health');
+  expect(res.status()).toBe(200);
+  const body = await res.json();
+  expect(body.status).toBe('ok');
+});
+
+// ── Auth ──────────────────────────────────────────────────────────────────────
+
+test('@smoke auth register + login roundtrip', async ({ request }) => {
+  const user = createTestUser();
+  const registered = await registerUser(request, user);
+
+  expect(registered).toHaveProperty('accessToken');
+  expect(registered).toHaveProperty('refreshToken');
+  expect(typeof registered.accessToken).toBe('string');
+
+  const loginRes = await request.post('auth/login', {
+    data: { phone: user.phone, password: user.password },
+  });
+  expect(loginRes.status()).toBe(201);
+  const tokens = await loginRes.json();
+  expect(tokens).toHaveProperty('accessToken');
+});
+
+test('@smoke auth token refresh', async ({ request }) => {
+  const user = createTestUser();
+  const { refreshToken } = await registerUser(request, user);
+
+  const res = await request.post('auth/refresh', {
+    data: { refreshToken },
+  });
+  expect(res.status()).toBe(201);
+  const body = await res.json();
+  expect(body).toHaveProperty('accessToken');
+});
+
+test('@smoke protected route rejects unauthenticated request', async ({ request }) => {
+  const res = await request.get('auth/profile');
+  expect([401, 403]).toContain(res.status());
+});
+
+// ── Listings ─────────────────────────────────────────────────────────────────
+
+test('@smoke listings list returns paginated results', async ({ request }) => {
+  const res = await request.get('listings', {
+    params: { page: 1, limit: 5 },
+  });
+  expect(res.status()).toBe(200);
+  const body = await res.json();
+  expect(body).toHaveProperty('data');
+  expect(Array.isArray(body.data)).toBeTruthy();
+  expect(body).toHaveProperty('meta');
+});
+
+test('@smoke listing creation requires auth', async ({ request }) => {
+  const res = await request.post('listings', {
+    data: { title: 'Smoke test listing' },
+  });
+  expect([401, 403]).toContain(res.status());
+});
+
+// ── Search ────────────────────────────────────────────────────────────────────
+
+test('@smoke search endpoint is reachable', async ({ request }) => {
+  const res = await request.get('search', {
+    params: { q: 'apartment', limit: 5 },
+  });
+  // 200 = Typesense available; 500/503 = service unavailable (accepted in smoke)
+  expect([200, 500, 503]).toContain(res.status());
+});
+
+test('@smoke geo search endpoint is reachable', async ({ request }) => {
+  const res = await request.get('search/geo', {
+    params: { lat: 10.7769, lng: 106.7009, radius: 5000, limit: 5 },
+  });
+  expect([200, 500, 503]).toContain(res.status());
+});
+
+// ── Payments ──────────────────────────────────────────────────────────────────
+
+test('@smoke payment initiation requires auth', async ({ request }) => {
+  const res = await request.post('payments', {
+    data: { amount: 100000, gateway: 'VNPAY' },
+  });
+  expect([401, 403]).toContain(res.status());
+});
+
+// ── Subscriptions ─────────────────────────────────────────────────────────────
+
+test('@smoke subscription plans are publicly readable', async ({ request }) => {
+  const res = await request.get('subscriptions/plans');
+  expect(res.status()).toBe(200);
+  const body = await res.json();
+  expect(Array.isArray(body)).toBeTruthy();
+});
+
+// ── Inquiries ─────────────────────────────────────────────────────────────────
+
+test('@smoke inquiry creation requires auth', async ({ request }) => {
+  const res = await request.post('inquiries', {
+    data: { listingId: 'smoke-listing-id', message: 'Smoke test inquiry' },
+  });
+  expect([401, 403]).toContain(res.status());
+});

e2e/web/smoke.spec.ts

@@ -0,0 +1,111 @@
+/**
+ * Smoke suite — Web
+ *
+ * Runs after every deploy to verify critical frontend pages load and
+ * render key UI elements.  Tagged with @smoke for targeted execution:
+ *
+ *   npx playwright test --project=web --grep @smoke
+ *
+ * Tests avoid user interactions that require a live API/auth session so
+ * they remain fast and resilient in staging environments.
+ */
+import { test, expect } from '@playwright/test';
+
+// ── Homepage ──────────────────────────────────────────────────────────────────
+
+test('@smoke homepage loads', async ({ page }) => {
+  await page.goto('/');
+  await expect(page).toHaveTitle(/.+/);
+  // Search bar or hero section must be visible
+  const searchInput = page.getByRole('searchbox').or(page.getByPlaceholder(/tìm kiếm|search/i));
+  await expect(searchInput.first()).toBeVisible({ timeout: 10_000 });
+});
+
+// ── Auth pages ────────────────────────────────────────────────────────────────
+
+test('@smoke login page renders form', async ({ page }) => {
+  await page.goto('/login');
+  await expect(page.getByRole('heading', { name: /đăng nhập/i })).toBeVisible();
+  await expect(page.getByLabel(/số điện thoại/i)).toBeVisible();
+  await expect(page.getByLabel(/mật khẩu/i)).toBeVisible();
+  await expect(page.getByRole('button', { name: /đăng nhập/i })).toBeVisible();
+});
+
+test('@smoke register page renders form', async ({ page }) => {
+  await page.goto('/register');
+  await expect(page.getByRole('heading', { name: /đăng ký/i })).toBeVisible();
+  await expect(page.getByLabel(/số điện thoại/i)).toBeVisible();
+});
+
+// ── Listings ──────────────────────────────────────────────────────────────────
+
+test('@smoke listings page loads without JS errors', async ({ page }) => {
+  const errors: string[] = [];
+  page.on('pageerror', (err) => errors.push(err.message));
+
+  await page.goto('/listings');
+  // Allow time for async data loading
+  await page.waitForLoadState('networkidle', { timeout: 15_000 }).catch(() => {
+    // networkidle may not be reached if polling; continue
+  });
+
+  // Page must not show an unhandled error boundary
+  const errorHeading = page.getByRole('heading', { name: /500|something went wrong|lỗi/i });
+  await expect(errorHeading).not.toBeVisible();
+
+  // Filter JS errors that are not related to missing env vars in test
+  const fatalErrors = errors.filter(
+    (e) => !e.includes('NEXT_PUBLIC') && !e.includes('mapbox'),
+  );
+  expect(fatalErrors).toHaveLength(0);
+});
+
+// ── Search ────────────────────────────────────────────────────────────────────
+
+test('@smoke search page is accessible', async ({ page }) => {
+  await page.goto('/search?q=apartment');
+  await expect(page).not.toHaveTitle(/404|not found/i);
+  // Some results container or empty-state must be present
+  const container = page
+    .locator('[data-testid="search-results"]')
+    .or(page.locator('[data-testid="empty-state"]'))
+    .or(page.getByText(/kết quả|results|không tìm thấy/i));
+  // Be lenient — search service may be unavailable in staging
+  await page.waitForTimeout(3000);
+  // Just confirm no crash
+  const errorBoundary = page.getByRole('heading', { name: /500|server error/i });
+  await expect(errorBoundary).not.toBeVisible();
+});
+
+// ── Listing Detail ────────────────────────────────────────────────────────────
+
+test('@smoke listing detail page handles missing id gracefully', async ({ page }) => {
+  const res = await page.goto('/listings/nonexistent-smoke-test-id');
+  // Should render 404 page, not crash with 500
+  const status = res?.status();
+  if (status && status >= 500) {
+    throw new Error(`Listing detail returned ${status} for unknown ID (expected 404)`);
+  }
+});
+
+// ── Static / infra ────────────────────────────────────────────────────────────
+
+test('@smoke no console errors on login page', async ({ page }) => {
+  const consoleErrors: string[] = [];
+  page.on('console', (msg) => {
+    if (msg.type() === 'error') consoleErrors.push(msg.text());
+  });
+
+  await page.goto('/login');
+  await page.waitForLoadState('domcontentloaded');
+
+  // Filter noise from third-party scripts / mapbox in test env
+  const meaningful = consoleErrors.filter(
+    (e) =>
+      !e.includes('mapbox') &&
+      !e.includes('NEXT_PUBLIC') &&
+      !e.includes('Failed to load resource') &&
+      !e.includes('net::ERR'),
+  );
+  expect(meaningful).toHaveLength(0);
+});