Hardening 9: add real browser/API test coverage and deployment gates

[Occumed79]

Parent: #170

Goal

Turn current source-oriented smoke coverage into executed browser/API acceptance that blocks regressions before and after deployment.

Browser matrix

Use Playwright for:

• Chromium
• WebKit
• Firefox

Required viewports/routes:

• desktop
• smaller laptop
• tablet portrait/landscape where relevant
• mobile
• normal application route
• ?p2-preview=1

Required UI workflows

• Header search and suggestion behavior
• Sidebar/workspace switching and repeated transitions
• Modals/drawers/bottom sheets
• Provider search and result states using deterministic mocked services
• Provider layer toggles and map-engine behavior
• Upload preview/validation/commit UI against disposable test backend/data
• U.S. diagnostics
• Provider Explorer/Dataset Browser
• Report/PDF preview
• Keyboard navigation/focus/Escape behavior
• Empty/loading/error/disabled/partial/degraded states
• Critical screenshot/visual comparisons

API/database coverage

• API integration tests against temporary disposable database(s)
• Migration apply/startup tests
• Schema drift check
• Auth/CORS/rate-limit/idempotency tests
• Upload transaction/rollback tests
• Provider-search normalization/dedupe/radius tests
• External-source failure simulations

CI quality gates

• Real ESLint configuration; lint must not merely alias TypeScript checking.
• Dependency vulnerability scanning with a documented severity policy.
• Bundle-size budgets.
• Dead-code detection.
• Circular-dependency detection.
• Browser console/page-error failure policy.
• Artifacts on failure: screenshots, traces, console/network logs where safe.

Deployment gate

• Production smoke must run after deployment against https://network-map-tool-mqib.onrender.com.
• Verify the exact deployed revision before accepting the smoke result; a responding URL alone is insufficient.
• Production-safe subset must not mutate provider data or perform destructive operations.
• Define automatic rollback/failed-deployment criteria when readiness or required browser acceptance fails; if Render automation cannot perform rollback directly, fail loudly and document the manual rollback target/revision.

Acceptance

• Primary Validate workflow runs required browser/API tests, not only source smoke scripts.
• All three browser engines are exercised on critical flows.
• Temporary DB integration tests are reproducible in CI.
• Critical visual baselines are stable and reviewed.
• Post-deployment acceptance identifies and tests the exact deployed commit.