test: playkit v0.3.1 adoption, Zod widening, PROD smoke, NextAuth write gates (#68)

e2e/tests/prod.smoke.spec.ts

@@ -0,0 +1,36 @@
+import { test as base, expect } from '@playwright/test';
+import { assertPublicHost } from '@levkin/playkit';
+
+/**
+ * PROD smoke: health + public login page only — no mutating actions, no
+ * login attempt, no LAN-only FastAPI dependency. Deliberately does NOT use
+ * the shared `fixtures.ts` (`api`/`playkitConfig` there resolve to DEV via
+ * `env-defaults.json`); PROD has its own base URL, set only when the PROD
+ * LXC actually exists (`vault_punimtag_nextauth_url_prod` is unset today —
+ * LXC 9103 hasn't been provisioned, see ROADMAP "Ops / docs debt").
+ *
+ * Set `PROD_BASE_URL` (e.g. `https://punimtag.levkin.ca`) to enable; skips
+ * otherwise so this spec is a no-op until PROD ships.
+ */
+const prodBaseUrl = process.env.PROD_BASE_URL || '';
+
+base.describe('PROD smoke @prod', () => {
+  base.skip(!prodBaseUrl, 'PROD_BASE_URL not set — PROD LXC not provisioned yet');
+
+  base('health endpoint reports ok', async ({ request }) => {
+    assertPublicHost(prodBaseUrl);
+    const res = await request.get(`${prodBaseUrl}/api/health`);
+    expect(res.ok()).toBeTruthy();
+    const body = await res.json();
+    expect(body.status).toBe('ok');
+  });
+
+  base('login page loads on the public host', async ({ page }) => {
+    assertPublicHost(prodBaseUrl);
+    await page.goto(`${prodBaseUrl}/login`);
+    expect(new URL(page.url()).hostname).toBe(new URL(prodBaseUrl).hostname);
+    await expect(page.getByRole('button', { name: /Sign in/i })).toBeVisible({
+      timeout: 20_000,
+    });
+  });
+});