ci(deploy): warm up root path before smoke tests

Dockerfile.dev serves via 'pnpm dev', so Next.js JIT-compiles routes on
first hit. On the QNAP runner, the cold compile of the root page +
middleware can take >10s and occasionally OOM-kills a worker, causing
test #2 (unauthenticated / → signin) to hit ERR_CONNECTION_REFUSED
while the other smoke tests (which target /auth/signin, pre-warmed via
admin-login steps) pass fine. Add an explicit curl warm-up loop so
Playwright only runs against a ready server.

.github/workflows/ci.yml

@@ -477,6 +477,23 @@ jobs:
           echo "$BODY"
           echo "$BODY" | grep '"status":"ok"'
 
+      - name: Warm up root path (Next.js dev compile)
+        # Dockerfile.dev runs `pnpm dev`, so Next.js compiles pages on the
+        # first request. The middleware+root combo on a cold server can
+        # take >10s to JIT-compile and sometimes OOM-kills a worker on the
+        # QNAP runner, causing the "unauthenticated root redirects" smoke
+        # test to hit ERR_CONNECTION_REFUSED. Warm the route here so the
+        # smoke run only exercises a ready server.
+        run: |
+          for i in $(seq 1 12); do
+            CODE=$(curl -s -o /dev/null -w "%{http_code}" -L --max-time 30 http://app:3100/ || echo "000")
+            echo "Warm-up $i: HTTP $CODE"
+            # Follow-redirect lands on /auth/signin which returns 200.
+            if [ "$CODE" = "200" ]; then exit 0; fi
+            sleep 5
+          done
+          echo "Warm-up did not reach 200; continuing anyway"
+
       - name: Seed admin user
         # setup-admin.mjs imports @prisma/client and @node-rs/argon2, both of
         # which live only in packages/db/node_modules under pnpm workspaces.