phase4 deploy: hosted build args for the frontend image + /api/config 401 auth smoke (T-4.3/T-4.7(1) host leg)

.ciagent/release/deploy.sh

@@ -204,7 +204,10 @@ SSH "cd '$RELEASE_DIR/backend' && \
   docker build -t '$IMAGE_BACKEND:$VERSION' -t '$IMAGE_BACKEND:latest' ." \
   || die "backend docker build failed on host" 4
 SSH "cd '$RELEASE_DIR/frontend' && \
-  docker build -t '$IMAGE_NAME:$VERSION' -t '$IMAGE_NAME:latest' ." \
+  docker build \
+    --build-arg NEXT_PUBLIC_RESEARCHX_API_MODE=live \
+    --build-arg NEXT_PUBLIC_API_BASE_URL=\"\" \
+    -t '$IMAGE_NAME:$VERSION' -t '$IMAGE_NAME:latest' ." \
   || die "frontend docker build failed on host" 4
 
 # ---- swap container ------------------------------------------------------
@@ -260,6 +263,17 @@ log "checking the backend can write its data root"
 SSH "docker exec '$CONTAINER_BACKEND' sh -c 'touch \"\$RESEARCHX_DATA_DIR/.write-probe\" && rm -f \"\$RESEARCHX_DATA_DIR/.write-probe\"'" \
   || die "backend data root is not writable by the container user" 5
 
+# Auth smoke (RESEARCH-v03.md section 10 pitfall; PLAN.md T-4.7(1) host-side
+# leg): the auth-guarded surface answers 401 unauthenticated. This proves
+# the guarded surface is up through the deployed backend -- it does NOT
+# discriminate the serving entrypoint (both create_app shapes default
+# auth_enabled=True; the entrypoint is pinned by the Dockerfile CMD + the
+# build-stage assert). The live-mode tier marker (an authenticated
+# /api/config) rides the staged smoke suite, owner directive (D-019).
+log "checking GET /api/config answers 401 unauthenticated"
+AUTH_CODE=$(SSH "curl -s -o /dev/null -w '%{http_code}' 'http://127.0.0.1:$HOST_PORT_BACKEND/api/config'")
+[ "$AUTH_CODE" = "401" ] || die "GET /api/config answered '$AUTH_CODE' unauthenticated, expected 401" 5
+
 log "health-checking frontend http://$DEPLOY_HOST:$HOST_PORT$HEALTH_PATH (retries: $HEALTH_RETRIES)"
 i=0
 while [ "$i" -lt "$HEALTH_RETRIES" ]; do