test(deploy): add onboarding smoke-test script

verify-onboarding.sh runs the self-register + claim chain against a live
APESS API and asserts each HTTP status (correct/wrong fleet secret,
wrong code, unknown kit, successful claim, status, cleanup). Proven
end-to-end against a local API (7/7). bash 3.2-safe (no apostrophes in
${:?} messages, temp-file body capture).

  API=… FLEET_SECRET=… [ADMIN_CODE=…] deploy/verify-onboarding.sh

Co-Authored-By: Claude Opus 4.8 <[email protected]>

deploy/verify-onboarding.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Smoke-tests the board onboarding chain (self-register + claim) against a live
+# APESS API. Runs a handful of requests and asserts the HTTP status of each.
+#
+#   API=https://apess-api.redclaw.dev FLEET_SECRET=apress2026 \
+#     [ADMIN_CODE=adm-...] ./verify-onboarding.sh
+#
+# ADMIN_CODE is optional but recommended - it lets the script delete the test
+# node binding afterwards. NOTE: a claim always upserts a team, so the throwaway
+# team ($TEAM, default "team-verify") will linger in the roster; it is inert and
+# safe to ignore.
+set -uo pipefail
+
+API="${API:-https://apess-api.redclaw.dev}"
+FLEET_SECRET="${FLEET_SECRET:?set FLEET_SECRET (must match the API FLEET_SECRET)}"
+ADMIN_CODE="${ADMIN_CODE:-}"
+KIT="${KIT:-KIT-VERIFY}"
+TEAM="${TEAM:-team-verify}"
+CODE="${CODE:-135790}"
+
+pass=0 fail=0 body=""
+G=$'\033[32m' R=$'\033[31m' Z=$'\033[0m'
+
+# hit METHOD PATH EXPECTED [curl args...] - captures body + status, asserts code.
+hit() {
+  local method="$1" path="$2" expect="$3"; shift 3
+  local tmp code
+  tmp=$(mktemp)
+  code=$(curl -sS -X "$method" "$API$path" -o "$tmp" -w '%{http_code}' "$@" 2>/dev/null)
+  body=$(cat "$tmp"); rm -f "$tmp"
+  if [ "$code" = "$expect" ]; then
+    printf '  %sPASS%s %-6s %-26s -> %s\n' "$G" "$Z" "$method" "$path" "$code"
+    pass=$((pass + 1))
+  else
+    printf '  %sFAIL%s %-6s %-26s -> %s (expected %s)\n       %s\n' "$R" "$Z" "$method" "$path" "$code" "$expect" "$body"
+    fail=$((fail + 1))
+  fi
+}
+
+json='content-type: application/json'
+echo "APESS onboarding verify -> $API  (kit=$KIT team=$TEAM)"
+
+# 1. a board announces itself with the right fleet secret
+hit POST /nodes/self-register 201 -H "x-fleet-secret: $FLEET_SECRET" -H "$json" \
+  -d "{\"kitId\":\"$KIT\",\"url\":\"http://127.0.0.1:8080\",\"token\":\"verify-token\",\"claimCode\":\"$CODE\"}"
+# 2. a wrong fleet secret is rejected
+hit POST /nodes/self-register 401 -H 'x-fleet-secret: wrong-secret' -H "$json" \
+  -d '{"kitId":"x","url":"y","token":"z","claimCode":"1"}'
+# 3. a wrong claim code is rejected (kit stays in the pool)
+hit POST /claim 401 -H "$json" -d "{\"kit\":\"$KIT\",\"teamId\":\"$TEAM\",\"code\":\"000000\"}"
+# 4. an unknown kit is a 404
+hit POST /claim 404 -H "$json" -d "{\"kit\":\"KIT-NOPE\",\"teamId\":\"$TEAM\",\"code\":\"$CODE\"}"
+# 5. the correct code claims the board (online:false is expected - the url is fake)
+hit POST /claim 201 -H "$json" -d "{\"kit\":\"$KIT\",\"teamId\":\"$TEAM\",\"code\":\"$CODE\"}"
+# 6. the board is now visible via the public status endpoint
+hit GET "/nodes/$TEAM/status" 200
+
+# cleanup (needs the admin code) - removes the test node binding
+if [ -n "$ADMIN_CODE" ]; then
+  hit DELETE "/nodes/$TEAM" 204 -H "x-access-code: $ADMIN_CODE"
+else
+  echo "  (set ADMIN_CODE to auto-delete the test node binding)"
+fi
+
+echo "------------------------------------------"
+printf 'Result: %s%d passed%s, %s%d failed%s\n' "$G" "$pass" "$Z" "$([ "$fail" -gt 0 ] && echo "$R")" "$fail" "$Z"
+[ "$fail" -eq 0 ]