docs: operations runbook, README verify section, frontend env example

- docs/OPERATIONS.md: deploy flow + rollback, health endpoints, backup/
  restore procedure, audit queries, monitoring stack routine
- README: verification now points at readiness/metrics endpoints and the
  authenticated smoke tests (bare quotes curl is 401 by design)
- frontend/.env.example: observability vars documented

README.md

@@ -214,15 +214,23 @@ All should show `Up` (postgres also `(healthy)`).
 | Frontend UI | http://localhost |
 | API docs (Swagger) | http://localhost:8000/docs |
 | API health | http://localhost:8000/health → `{"status":"ok","service":"procurement-api"}` |
+| API readiness (DB + MinIO + Casdoor) | http://localhost:8000/health/ready |
+| Metrics | http://localhost:8000/metrics |
 | MinIO console | http://localhost:9001 (user/pass `minioadmin`/`minioadmin`) |
 | Database | `localhost:5433`, db `procurement`, user/pass `postgres`/`postgres` (Casdoor uses the same instance, db `casdoor`) |
 
-Quick end-to-end check (Traefik → frontend proxy → API → DB):
+Automated end-to-end checks (authenticates via `SMOKE_USER` /
+`SMOKE_PASSWORD` — the seeder users):
 
 ```powershell
-curl http://localhost/api/v1/quotes?expand=supplier,project,line_items,termsheets,events,decision,receipt
+backend\tools\smoke_test.py   # read paths
+backend\tools\smoke_test_write.py / smoke_test_misc.py
 ```
 
+> Every API route now requires a Casdoor JWT — a bare
+> `curl http://localhost/api/v1/quotes` returns **401** by design.
+> Day-2 operations (deploys, backups, monitoring): [`docs/OPERATIONS.md`](docs/OPERATIONS.md).
+
 ---
 
 ## MinIO (object storage for invoice / proforma files)