fix(tests): refresh nightly docker-e2e asserts after auth + health refactors (#69)

Two assertions in the docker-marker test files had drifted from the live API
and were only caught by the scheduled nightly CI job (run #24947963804,
2026-04-26 04:12 UTC):

- tests/test_docker_full.py::test_app_returns_html_on_root expected 200 on
  GET / — but app/web/router.py:189-193 always returns 302 (to /dashboard
  for authenticated users, /login otherwise) since the auth middleware
  landed. Updated to use follow_redirects=False and assert 302 + location.

- tests/test_e2e_docker.py::TestDockerHealth::test_health_has_duckdb read
  data["checks"]["duckdb"|"database"] — but the health payload shape is
  {"services": {"duckdb_state": ..., "data": ..., "users": ...}} and has
  been since app/api/health.py was last refactored. Updated to read
  services["duckdb_state"]["status"] — same pattern used by the (passing)
  tests/test_api.py::TestHealth suite, so the two test layers now agree.

Both fixes are test-only; no application behavior changes.

CHANGELOG.md

@@ -13,6 +13,10 @@ CalVer image tags (`stable-YYYY.MM.N`, `dev-YYYY.MM.N`) are produced for every C
 <!-- Add bullets here. Group: Added / Changed / Fixed / Removed / Internal.
      Mark breaking changes with **BREAKING** at the start of the bullet. -->
 
+### Internal
+
+- Fix nightly `docker-e2e` CI failures: refresh two stale assertions that had drifted from the live API. `tests/test_docker_full.py::test_app_returns_html_on_root` now expects the auth-aware `302 → /login` (root has redirected since the auth middleware landed); `tests/test_e2e_docker.py::TestDockerHealth::test_health_has_duckdb` now reads `services["duckdb_state"]` (current health-payload shape, already validated by `tests/test_api.py`). No application behavior change — these only ran in the scheduled nightly job, so the drift went unnoticed for several PRs.
+
 ## [0.11.1] — 2026-04-26
 
 Patch release — hotfix the missed Caddy env passthrough that should have shipped with 0.11.0, plus codify changelog discipline so this kind of drift gets caught at PR review time next time.

tests/test_docker_full.py

@@ -49,9 +49,10 @@ def test_app_health():
 
 
 def test_app_returns_html_on_root():
-    """GET / returns 200 (HTML dashboard)."""
-    resp = httpx.get(f"{DOCKER_BASE_URL}/", timeout=10)
-    assert resp.status_code == 200
+    """GET / redirects unauthenticated callers — / always 302s to /login or /dashboard."""
+    resp = httpx.get(f"{DOCKER_BASE_URL}/", timeout=10, follow_redirects=False)
+    assert resp.status_code == 302
+    assert resp.headers.get("location") in ("/login", "/dashboard")
 
 
 def test_bootstrap_creates_admin():

tests/test_e2e_docker.py

@@ -78,8 +78,9 @@ class TestDockerHealth:
         import httpx
         resp = httpx.get(f"{docker_env}/api/health")
         data = resp.json()
-        checks = data.get("checks", {})
-        assert "duckdb" in checks or "database" in checks
+        services = data.get("services", {})
+        assert "duckdb_state" in services
+        assert services["duckdb_state"]["status"] == "ok"
 
 
 class TestDockerFullFlow: