Allow protected scan terminal deploy smoke

deploy.sh

@@ -209,25 +209,33 @@ warm_public_route() {
     return 0
 }
 
-wait_for_scan_terminal_ready() {
+wait_for_scan_terminal_snapshot() {
     local name="$1"
     local url="$2"
     local timeout="${3:-35}"
     local attempts="${4:-8}"
     local delay="${5:-5}"
     local output=""
+    local body=""
     local compact=""
+    local http_status=""
     local status=""
 
     for i in $(seq 1 "$attempts"); do
-        if output=$(curl -fsS --max-time "$timeout" "$url" 2>&1); then
+        if output=$(curl -sS -w "\nhttp=%{http_code}" --max-time "$timeout" "$url" 2>&1); then
-            compact="$(printf '%s' "$output" | tr -d '\n\r\t ')"
+            http_status="$(printf '%s\n' "$output" | sed -n 's/^http=//p' | tail -n 1)"
+            body="$(printf '%s\n' "$output" | sed '$d')"
+            if [ "$http_status" = "401" ]; then
+                echo "✅ $name protected after attempt $i/$attempts (http=401)"
+                return 0
+            fi
+            compact="$(printf '%s' "$body" | tr -d '\n\r\t ')"
             if printf '%s' "$compact" | grep -q '"status":"ready"'; then
                 echo "✅ $name ready after attempt $i/$attempts"
                 return 0
             fi
             status="$(printf '%s' "$compact" | sed -n 's/.*"status":"\([^"]*\)".*/\1/p' | head -n 1)"
-            echo "   $name not ready attempt $i/$attempts status=${status:-unknown}"
+            echo "   $name not ready attempt $i/$attempts http=${http_status:-unknown} status=${status:-unknown}"
         else
             echo "   $name request failed attempt $i/$attempts ($output)"
         fi
@@ -236,7 +244,7 @@ wait_for_scan_terminal_ready() {
         fi
     done
 
-    echo "❌ $name did not return status=ready"
+    echo "❌ $name did not return status=ready or http=401"
     return 1
 }
 
@@ -320,7 +328,7 @@ compose_up_retry "frontend" -d --no-deps polyweather_frontend
 echo "Waiting for frontend..."
 wait_for_local_service "frontend root" "http://127.0.0.1:3001/" 5 40 2 || FAILED_FRONTEND=1
 wait_for_local_service "frontend terminal" "http://127.0.0.1:3001/terminal" 10 20 2 || FAILED_FRONTEND=1
-wait_for_scan_terminal_ready "scan terminal snapshot" "http://127.0.0.1:3001/api/scan/terminal" 35 8 5 || FAILED_FRONTEND=1
+wait_for_scan_terminal_snapshot "scan terminal snapshot" "http://127.0.0.1:3001/api/scan/terminal" 35 8 5 || FAILED_FRONTEND=1
 FAILED_FRONTEND="${FAILED_FRONTEND:-0}"
 if [ "$FAILED_FRONTEND" = "1" ]; then
     echo "❌ Frontend did not become healthy"

tests/test_deployment_runtime_config.py

@@ -206,10 +206,11 @@ def test_deploy_script_retries_startup_smoke_checks():
     script = (ROOT / "deploy.sh").read_text(encoding="utf-8")
 
     assert "smoke_check()" in script
-    assert "wait_for_scan_terminal_ready()" in script
+    assert "wait_for_scan_terminal_snapshot()" in script
     assert '"status":"ready"' in script
-    assert 'wait_for_scan_terminal_ready "scan terminal snapshot" "http://127.0.0.1:3001/api/scan/terminal"' in script
+    assert "http=401" in script
-    assert script.index("wait_for_scan_terminal_ready") < script.index("run_public_smoke_checks")
+    assert 'wait_for_scan_terminal_snapshot "scan terminal snapshot" "http://127.0.0.1:3001/api/scan/terminal"' in script
+    assert script.index("wait_for_scan_terminal_snapshot") < script.index("run_public_smoke_checks")
     assert 'smoke_check "healthz" "https://api.polyweather.top/healthz" 15 3 5' in script
     assert 'warm_public_route "local cities recent stats" "http://127.0.0.1:8000/api/cities?refresh_deb_recent=1"' in script
     assert 'warm_public_route "scan terminal" "https://polyweather.top/api/scan/terminal"' in script