Improve hosted smoke verification for protected staging

[dills122]

Summary

• Extends hosted smoke coverage for staging and production hosting paths.
• Supports Cloudflare Access-protected staging while keeping production public web checks intact.
• Wires hosted smoke checks into the manual deploy workflow by default.

What Changed

• Added FORAGE_WEB_SMOKE_MODE=access-protected for staging smoke checks behind Cloudflare Access.
• Added hosted checks for unauthenticated session response shape.
• Added OAuth start checks for GitHub redirect, PKCE parameters, state, and cookie attributes.
• Updated deploy workflow to pass staging/production smoke settings automatically.
• Updated hosting, CI, and deployment docs with the new smoke modes and commands.

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/deploy.yml"); puts "deploy workflow YAML parses"'
• npm run check:scripts
• npm run check:docs
• npm run lint
• FORAGE_WEB_ORIGIN=https://forage-staging.shrimpworks.dev FORAGE_WORKER_ORIGIN=https://api-staging.forage.shrimpworks.dev FORAGE_SMOKE_EXPECT_PRODUCTION=false FORAGE_WEB_SMOKE_MODE=access-protected pnpm smoke:hosted
• npm run check

Scope Notes

• Live hosted smoke remains outside the default Check workflow because it depends on deployed Cloudflare domains.
• Deploy workflow now runs hosted smoke by default for manual deploys.
• Staging expects Cloudflare Access protection; production expects public Pages HTML/security headers.