test(smoke): assert the login shell serves on a fresh install

[Spoofiecus]

Summary

The fresh-install smoke test added in #6294 proves the API is healthy on a clean install but never asserts that the UI itself is reachable — the smoke contract in #3968 explicitly lists "confirm the UI can become available when applicable". A regression that broke only the static/login shell (while /api/health stayed green) would pass the current smoke gate.

This adds one test, test_root_serves_login_shell_html, to tests/test_smoke_install.py. It boots the app the same way the existing health test does (in-memory SQLite, every optional-service probe pointed at a dead port) and asserts that GET / either serves the first-run login shell (HTML document with the responsive viewport meta) or redirects to /login — and follows that redirect to confirm the shell really comes back. A 5xx, an unexpected redirect target, or a non-HTML body fails.

Target branch

• This PR targets **dev**, not main. All PRs land in dev.

Type of Change

• Test coverage improvement (no production code change)

Linked Issue

Part of #3968 (fresh-install smoke contract — the "UI can become available" item).

Checklist

• I searched open issues and open PRs — this is not a duplicate.
• This PR targets dev
• My changes are limited to the scope described above — no unrelated refactors or whitespace changes mixed in.
• I actually ran the app (docker compose up or uvicorn app:app) and verified the change works end-to-end. Type-checks and unit tests are not enough.

How to Test

All commands run with the project venv interpreter; all green before pushing:

• ./venv/bin/python -m pytest tests/test_smoke_install.py -v -> 11 passed (5 prior + the new one)
• ./venv/bin/python -m py_compile tests/test_smoke_install.py -> clean
• git diff --check -> clean

Runtime validation: the same scratch single-user instance used to validate the storage diagnostic (#6320) served / as the login shell with the viewport meta — the assertions encode exactly that observed behavior (first-run redirect to /login, then an HTML shell document). No production code is touched; this is a test-only PR.

Scope

One new test in the existing smoke-test file. No production code, no new fixtures, no new dependencies.