ci(deploy): wire Playwright smoke suite into deploy pipeline

Staging and production smoke-test jobs now run both the existing bash
smoke-test.sh (fast endpoint checks) and the new Playwright @smoke projects
(smoke-api + smoke-web) against live deployed URLs. Failure blocks the
rollback trigger just as before.

Required secrets: STAGING_API_URL, PRODUCTION_API_URL (added alongside the
existing STAGING_URL / PRODUCTION_URL).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/deploy.yml

@@ -282,13 +282,61 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Run smoke tests
+      - name: Run bash smoke tests
         env:
           STAGING_URL: ${{ secrets.STAGING_URL }}
         run: |
           chmod +x scripts/smoke-test.sh
           ./scripts/smoke-test.sh "$STAGING_URL"
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: npx playwright install --with-deps chromium
+
+      - name: Install Playwright system deps
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: npx playwright install-deps chromium
+
+      - name: Run Playwright smoke tests (API)
+        env:
+          API_BASE_URL: ${{ secrets.STAGING_API_URL }}
+          CI: true
+        run: npx playwright test --project=smoke-api
+
+      - name: Run Playwright smoke tests (Web)
+        env:
+          API_BASE_URL: ${{ secrets.STAGING_API_URL }}
+          WEB_BASE_URL: ${{ secrets.STAGING_URL }}
+          CI: true
+        run: npx playwright test --project=smoke-web
+
+      - name: Upload Playwright smoke report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: smoke-report-staging-${{ github.run_id }}
+          path: playwright-report/
+          retention-days: 7
+
       - name: Cleanup old images after successful smoke tests
         if: success()
         env:
@@ -510,13 +558,61 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Run smoke tests
+      - name: Run bash smoke tests
         env:
           PRODUCTION_URL: ${{ secrets.PRODUCTION_URL }}
         run: |
           chmod +x scripts/smoke-test.sh
           ./scripts/smoke-test.sh "$PRODUCTION_URL"
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: npx playwright install --with-deps chromium
+
+      - name: Install Playwright system deps
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: npx playwright install-deps chromium
+
+      - name: Run Playwright smoke tests (API)
+        env:
+          API_BASE_URL: ${{ secrets.PRODUCTION_API_URL }}
+          CI: true
+        run: npx playwright test --project=smoke-api
+
+      - name: Run Playwright smoke tests (Web)
+        env:
+          API_BASE_URL: ${{ secrets.PRODUCTION_API_URL }}
+          WEB_BASE_URL: ${{ secrets.PRODUCTION_URL }}
+          CI: true
+        run: npx playwright test --project=smoke-web
+
+      - name: Upload Playwright smoke report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: smoke-report-production-${{ github.run_id }}
+          path: playwright-report/
+          retention-days: 14
+
       - name: Cleanup old images after successful smoke tests
         if: success()
         env: