test: add E2E smoke test script + CI gate

After deploying the binary against a fresh data dir and exercising every
major REST endpoint by hand, codify the verification as a re-runnable
script.

scripts/smoke-test.sh:
  - Spins up bin/mediastation-go against a tempdir.
  - Generates 3 sample clips (movie, tv, anime) + an external SRT.
  - Walks 26 assertions: health → auth → libraries → scan → ffprobe →
    season parser → search → range stream → HLS playlist → external
    subtitle → history → favourites → playlists → RBAC (alice 403) →
    NFO export → recycle bin → SPA fallback → graceful shutdown.
  - Tears the server down via SIGTERM and reports pass/fail counts.
  - Exits non-zero on any failure so CI can use it as a deployment gate.

Local verification on this branch: PASS=26  FAIL=0.

Wiring:
  - Makefile: new 'smoke' target, depends on 'build'.
  - .github/workflows/ci.yml: third job 'smoke' that depends on backend
    + frontend, installs ffmpeg, builds both halves, then runs the
    script. The CI pipeline now blocks merges that break end-to-end
    deployability.

.github/workflows/ci.yml

@@ -47,3 +47,29 @@ jobs:
 
       - name: Type-check & build
         run: npm run build
+
+  smoke:
+    name: E2E smoke test
+    runs-on: ubuntu-latest
+    needs: [backend, frontend]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache: true
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: web/package-lock.json
+      - name: Install ffmpeg
+        run: sudo apt-get update && sudo apt-get install -y ffmpeg
+      - name: Build backend
+        run: make build-server
+      - name: Build frontend
+        run: cd web && npm ci && npm run build
+      - name: Run smoke test
+        run: ./scripts/smoke-test.sh
+        env:
+          PORT: 18080