test: add deployment test tiers (shellcheck, hadolint, Docker smoke, integration)

Tier 1 — quality.yml: ShellCheck on lxc-install.sh, hadolint on both Dockerfiles
Tier 2 — docker-ci.yml: build images, smoke-test backend health + frontend 200
Tier 3 — test_integration.py: full stack pytest (auth, canvas save/reload, dimensions)
Also adds Docker healthcheck to backend service in docker-compose.yml

.github/workflows/docker-ci.yml

@@ -0,0 +1,90 @@
+name: Docker CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  smoke-and-integration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # ── Generate a bcrypt hash for the CI test password ────────────────────
+      - name: Generate CI password hash
+        id: pwhash
+        run: |
+          pip install --quiet passlib bcrypt
+          HASH=$(python3 -c "from passlib.context import CryptContext; print(CryptContext(schemes=['bcrypt']).hash('ci-password-123'))")
+          echo "hash=$HASH" >> "$GITHUB_OUTPUT"
+
+      # ── Write a minimal .env consumed by docker-compose.yml ───────────────
+      - name: Write .env
+        run: |
+          cat > .env <<'EOF'
+          SECRET_KEY=ci-only-secret-key-not-for-production
+          SQLITE_PATH=/app/data/homelab.db
+          CORS_ORIGINS=["http://localhost:3000"]
+          SCANNER_RANGES=["127.0.0.1/32"]
+          STATUS_CHECKER_INTERVAL=300
+          MCP_API_KEY=ci-mcp-key
+          MCP_SERVICE_KEY=ci-svc-key
+          AUTH_USERNAME=admin
+          EOF
+          echo "AUTH_PASSWORD_HASH=${{ steps.pwhash.outputs.hash }}" >> .env
+
+      # ── Build + start backend and frontend (skip mcp) ─────────────────────
+      - name: Build images
+        run: docker compose build backend frontend
+
+      - name: Start stack
+        run: docker compose up -d backend frontend
+
+      # ── Wait for backend to be healthy (max 60 s) ─────────────────────────
+      - name: Wait for backend health
+        run: |
+          echo "Waiting for backend..."
+          for i in $(seq 1 30); do
+            if curl -sf http://localhost:8000/api/v1/health > /dev/null 2>&1; then
+              echo "Backend is up after ${i}s"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "Backend did not become healthy in time" >&2
+          docker compose logs backend
+          exit 1
+
+      # ── Smoke: frontend serves HTML ────────────────────────────────────────
+      - name: Smoke — frontend returns 200
+        run: |
+          STATUS=$(curl -so /dev/null -w "%{http_code}" http://localhost:3000/)
+          [ "$STATUS" = "200" ] || { echo "Frontend returned $STATUS"; exit 1; }
+
+      # ── Tier 3: integration tests against the live stack ──────────────────
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install backend test deps
+        run: pip install --quiet -r backend/requirements.txt
+
+      - name: Run integration tests
+        env:
+          INTEGRATION_BASE_URL: http://localhost:8000
+          INTEGRATION_USERNAME: admin
+          INTEGRATION_PASSWORD: ci-password-123
+        run: |
+          cd backend
+          pytest tests/test_integration.py -v
+
+      # ── Teardown ───────────────────────────────────────────────────────────
+      - name: Dump logs on failure
+        if: failure()
+        run: docker compose logs
+
+      - name: Stop stack
+        if: always()
+        run: docker compose down -v

.github/workflows/quality.yml

@@ -7,6 +7,23 @@ on:
     branches: [main]
 
 jobs:
+  lint-scripts:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: ShellCheck — lxc-install.sh
+        uses: ludeeus/action-shellcheck@2.0.0
+        with:
+          scandir: './scripts'
+      - name: Hadolint — Dockerfile.backend
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: Dockerfile.backend
+      - name: Hadolint — Dockerfile.frontend
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: Dockerfile.frontend
+
   frontend:
     runs-on: ubuntu-latest
     defaults: