feat(BLOCK-S): never-lie-to-the-user-about-being-deployed pass

feat(BLOCK-S): never-lie-to-the-user-about-being-deployed pass

The user spent an entire day frustrated because:
  1. Migrations 0046-0053 silently failed to apply on the live DB
     after the PR #62 merge. /healthz still returned 200 (it doesn't
     touch the schema), so the deploy was marked SUCCEEDED while
     every page that queried `users` crashed. Login broken for ~7h.
  2. PWA service worker held the previous /login HTML in its own
     cache. Hard-refresh didn't beat it; user had to DevTools →
     Application → Service Workers → Unregister.
  3. Nothing alerted them. They had to discover the breakage by
     trying to log in.

This block makes those silent failures impossible.

S1+S3 — Make migrations fail loud + post-deploy smoke + auto-rollback
  scripts/post-deploy-smoke.ts (NEW) +
  src/lib/post-deploy-smoke.ts (NEW) +
  src/__tests__/post-deploy-smoke.test.ts (NEW) +
  .github/workflows/hetzner-deploy.yml (extended) +
  src/routes/version.ts (extended) + DEPLOY.md note.
  • db-migrate step now fails the workflow on any error (no more
    `|| echo WARN` swallow) AND writes a temporary
    verify-migration.mjs that aborts the deploy if the latest
    `drizzle/*.sql` filename isn't in the live DB's `_migrations`
    table.
  • New "Full post-deploy smoke suite" step runs after restart,
    curls 15 critical endpoints (/healthz, /readyz, /version,
    /login, /register, /, /explore, /demo, /pricing, /status,
    /api/v2/healthz, /mcp, /manifest.webmanifest, /sw.js,
    /gluecron.dxt), then curls /api/version and checks the
    server's reported migrations[] contains the latest filename.
  • Rollback step fires on either smoke step failing — once per
    workflow run — resets to the previous successful SHA,
    re-builds + re-restarts, verifies /healthz on the rolled-back
    state, and posts to /api/events/deploy/finished with status =
    failed + a ROLLED BACK reason header.
  • /api/version + /version now report `{sha, buildAt, migrations}`
    (last 5 applied) so the smoke suite (and humans) can verify
    schema parity.
  • 35 new tests covering CHECKS shape, every asserter, sequential
    ordering, fetch-throw handling, migration helpers.

S2 — Service worker cache-bust pinned to deploy SHA
  src/routes/pwa.ts (extended) +
  src/views/layout.tsx (extended) +
  src/__tests__/pwa-cache-bust.test.ts (NEW).
  • `/sw.js` is now built fresh from `buildVersionedServiceWorker()`
    at request time. Top of the body is `const SW_VERSION = "<sha>";`
    read from process.env.BUILD_SHA (or a stable dev-fallback with
    one-shot warn).
  • SW install handler calls `self.skipWaiting()` so the new SW
    activates immediately — no waiting for every tab to close.
  • SW activate handler deletes every previous gluecron-<version>
    cache so stale assets are nuked the moment the new SW takes
    over.
  • Layout's pwaRegisterScript extended with
    updatefound → statechange → window.location.reload() (gated
    on controller existence + a reloaded latch so the first
    install doesn't loop).
  • Result: the "I deployed but the user still sees the old page"
    window shrinks from "forever until DevTools" to "one auto-
    reload on the next page load".
  • `Cache-Control: no-store` on /sw.js itself so browsers always
    re-fetch the SW source on update probe.
  • Locked G1 SERVICE_WORKER_SRC constant left untouched (existing
    pwa.test.ts assertions still hold); the served body is built
    by the new helper.
  • 13 new tests.

S4 — Synthetic monitor every tick + red/green admin status
  drizzle/0054_synthetic_checks.sql (NEW) +
  src/lib/synthetic-monitor.ts (NEW) +
  src/routes/admin-status.tsx (NEW) +
  src/__tests__/synthetic-monitor.test.ts (NEW) +
  src/lib/autopilot.ts (extended) +
  src/routes/status.tsx (extended) + app.tsx mount.
  • 14 checks (same shape as S1+S3's smoke suite but URL-only:
    healthz / readyz / version / login renders / register renders
    / landing / explore / pricing / status / manifest / sw.js /
    gluecron.dxt / mcp discovery / robots.txt). Per-check timeout
    5s.
  • New `synthetic-monitor` autopilot task runs every tick. On
    green→red transition, posts to MONITOR_ALERT_WEBHOOK_URL
    (if env set). Persists every result to `synthetic_checks`
    with timestamp + duration + error.
  • SSE topic `monitor:synthetic` for live UI updates.
  • New `/admin/status` site-admin page renders the 14-row table
    with colored dots, status codes, durations, relative times.
    SSE-subscribes to monitor:synthetic so red transitions show
    up without a page reload. "Run all checks now" button bypasses
    the tick for instant verification.
  • Public `/status` page now has a "Recent incidents (last 24h)"
    section listing any check that went red.
  • 22 new tests.

──────────────────────────────────────────────────────────────────────
Test outcome
──────────────────────────────────────────────────────────────────────

bun test → 1936 tests / 1 fail / 2 skip across 139 files.

The 1 fail remains the pre-existing
`runScheduledWorkflowsTick — fail-open` cross-file mock-ordering
artifact (passes in isolation). Unchanged across BLOCK-P/Q/R/S.

Net +70 tests this block: S1+S3:35  S2:13  S4:22.

──────────────────────────────────────────────────────────────────────
What this changes for the operator
──────────────────────────────────────────────────────────────────────

• Deploy can no longer succeed silently with a broken schema.
  Migrations either apply OR the deploy auto-rolls back.
• Browser users see the new version on the next page load,
  automatically. No more DevTools dance.
• When something breaks, /admin/status flips red in seconds.
  Webhook alert fires on the green→red edge.
• The platform self-monitors. No more "the user is the QA team."