v0.9.1-rc: Release Candidate Validation & Deployment QA

[DeepZone]

Motivation

• Finalize release-candidate validation for deployment, upgrade safety, Docker runbook readiness, security posture and role-based UX quality before v1.0 without adding product features.
• Provide a small, verifiable smoke check for deployments and explicit operator runbooks for upgrades and Docker-based QA to reduce deployment/upgrade mistakes.
• Surface clear security and UX checklists so operators can validate production readiness (cookies, CORS, secrets, roles, backups, Alembic parity).

Description

• Added a deployment smoke script backend/scripts/check_deployment_health.py that validates backend /health, /api/system/status fields (version, read_only, database payload and migration status), frontend build artifacts (frontend/dist/index.html) and optionally /api/setup/required via --check-setup, and fails non-zero on issues.
• Expanded operations documentation with QA/runbook content in docs/operations/release-checklist.md, docs/operations/upgrades.md, docs/operations/database-migrations.md and docs/operations/security.md to cover upgrade QA matrices (fresh/older SQLite flows, safe use of alembic stamp), Docker QA commands, reverse-proxy and HTTPS cookie guidance, and security/UX checklists.
• Bumped product version strings to 0.9.1 / v0.9.1-rc across backend and frontend artifacts and test expectations (files updated include backend/pyproject.toml, backend/app/main.py, backend/app/core/system_status.py, backend/app/api/routes_system.py, backend/app/api/routes_health.py, frontend/package.json, frontend/src/App.tsx, README.md, ROADMAP.md, RELEASE_NOTES.md, and backend/tests/test_api_smoke.py).

Testing

• Ran backend unit tests with cd backend && pytest -q, which completed successfully: 102 passed (tests emitted warnings but all passed).
• Built the frontend with cd frontend && npm run build, which produced dist/ and completed successfully.
• Executed the deployment smoke script python backend/scripts/check_deployment_health.py --base-url http://localhost:8000 --check-setup, which correctly failed with a clean non-zero exit when the backend service was not reachable (Connection refused), demonstrating error handling and expected behavior when services are down.

---

Codex Task