Deploy and smoke test

Status. The kit was built and tested offline against a fake platform. It has not been run against a real host. Nothing is deployed. The kit is for the project owner's test host, not a customer feature. Full runbooks are in the repository under docs/deploy/.

All tools are in tools/deploy/, need Node 20 or newer and no packages, and work on local files only.

Tool	What it does
`gen-secrets.mjs`	Writes a settings file with generated peppers, signing and encryption keys and tokens for every module. Values go into the file (permissions `0600`, never overwritten), not to the console; the console prints names and the two public keys
`validate-secrets.mjs`	Lists missing, placeholder or invalid settings by name per module, and cross-checks them. Never prints a value
`smoke.mjs`	17-step post-deploy test: health, first-owner setup, API key, create site, strings, translate with the fake engine, publish, fetch and verify the signed bundle. Each step is PASS, FAIL or SKIP with the module to blame; secrets are scrubbed from output
`health-check.mjs`	One-line probe of the detailed health endpoint for cron or an uptime monitor (exit 0, 1 or 2)
`readiness-checklist.mjs`	What is still missing for production

node tools/deploy/gen-secrets.mjs --host my-test-site.example
node tools/deploy/validate-secrets.mjs App_Data/secrets.json
node tools/deploy/smoke.mjs --base https://my-test-site.example --secrets-file App_Data/secrets.json
node tools/deploy/health-check.mjs --base https://my-test-site.example --secrets-file App_Data/secrets.json

Skipped steps make the smoke test exit with code 2 unless you pass --allow-skips; for example the delivery steps need --delivery-base or --delivery-dir, and the crawl step needs a public page with --scan-url.

When a module is not configured, the platform stays up and reports it as not ready by setting name only (never a value); that module's routes are not served. Never commit the settings file.

Runbooks in the repository: docs/deploy/TEST_HOST.md (click-by-click), docs/deploy/OPERATIONS.md (logs, alerts, rollback), docs/ops/RUNBOOK.md and docs/launch/LAUNCH_CHECKLIST.md.