ci: add staging smoke test job before production release

[rudeus112266]

Summary

Adds a staging smoke-test job (scripts/smoke_test_staging.sh + .github/workflows/staging-smoke-test.yml) that exercises core flows — auth, GET /vaults, POST /vaults/{id}/checkin — against a staging deployment, to catch a backend/client shared/api-contract.md mismatch before a release build ships.

Context / design note

android-ci.yml and ios-ci.yml only cover build/test/lint, and there is no release-cut workflow in this repo yet to gate directly. Rather than invent a release workflow out of scope for this change, the smoke-test job is exposed via workflow_call (see comment in the workflow file) so that whichever workflow eventually cuts a release can add:

jobs:
  smoke-test:
    uses: ./.github/workflows/staging-smoke-test.yml
    secrets: inherit
  release:
    needs: smoke-test

Auth is verified via a long-lived smoke-test-account JWT (STAGING_SMOKE_TOKEN secret) rather than a live WebAuthn ceremony, since passkey signing isn't automatable in CI. The check-in call follows the anti-replay header contract (X-Nonce, X-Timestamp) documented in shared/api-contract.md.

Also documents the staging environment's relationship to API_BASE_URL in README.md — staging is a fixed CI-only target, distinct from the per-client API_BASE_URL configured in Info.plist / build.gradle.kts.

Testing

• bash -n scripts/smoke_test_staging.sh — syntax check passes
• Workflow YAML validated locally; not yet run against a live staging deployment since STAGING_API_BASE_URL/STAGING_SMOKE_TOKEN/STAGING_SMOKE_VAULT_ID secrets don't exist in this fork — these need to be provisioned in the upstream repo's Actions secrets for the job to run for real.

Closes #308

[drips-wave]

@rudeus112266 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits