feat(automation): staging-up.sh for pre-deploy smoke testing on pms1

Brings up pm2 'ppms-staging' on port 3200 from the latest master, against the
prod-mirror test DB in safe dev mode. Re-run to refresh to newer master.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

automation/README.md

@@ -82,6 +82,23 @@ Because the test DB is refreshed daily, anything the autofix writes to it (test
 schema experiments) is disposable. Schema-migration issues are routed to `interactive`
 by triage, so the unattended fixer should not be altering the schema anyway.
 
+## Staging (smoke test before deploy)
+
+`automation/staging-up.sh` (deployed to `~/issue-watcher/` on pms1) brings up a
+**staging instance of the latest `master`** so changes can be clicked through
+before a release tag deploys them to prod.
+
+- Checkout: `~/pelagia-staging` (separate from `~/pms` and `~/pelagia-autofix`)
+- Process: pm2 `ppms-staging` on **port 3200**, against the prod-mirror test DB
+  (`pelagia_test`), safe dev mode (console email, local storage, SSO disabled).
+- Refresh to newer master + restart: re-run `~/issue-watcher/staging-up.sh`.
+- Stop: `pm2 delete ppms-staging`.
+- Access: bound to all interfaces, so reachable at `http://<pms1-ip>:3200`. This is
+  **plain HTTP with prod-mirror data behind login** — for a private setup, restrict
+  to localhost (`pnpm dev -p 3200 -H 127.0.0.1` in `run-staging.sh`) and reach it via
+  `ssh -L 3200:localhost:3200 …` instead.
+- Log in with a password user (SSO is off here), e.g. `admin@pelagiamarine.com`.
+
 ## Issue label lifecycle
 
 ```

automation/staging-up.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Bring up / refresh the pms1 STAGING instance with the latest master, for smoke
+# testing before tagging a release. Runs the app as pm2 process `ppms-staging` on
+# port 3200, against the prod-mirror test DB (pelagia_test), in safe dev mode
+# (no real emails/uploads). Separate from ~/pms (prod) and ~/pelagia-autofix.
+#
+# Usage on pms1:  ~/issue-watcher/staging-up.sh
+# Re-run any time to pull latest master and restart staging.
+
+set -euo pipefail
+export NVM_DIR="$HOME/.nvm"; . "$NVM_DIR/nvm.sh"
+
+DIR="$HOME/pelagia-staging"
+PORT=3200
+NAME="ppms-staging"
+REPO_URL="http://127.0.0.1:3001/shad0w/pelagia-portal.git"
+
+if [ ! -d "$DIR/.git" ]; then
+    echo "Cloning into $DIR ..."
+    git clone -q "$REPO_URL" "$DIR"
+fi
+
+cd "$DIR"
+git fetch origin -q
+git checkout -f master -q 2>/dev/null || git checkout -fB master origin/master -q
+git reset --hard origin/master
+echo "Staging checkout: $(git log --oneline -1)"
+
+# One-time env: test DB, dev mode, port 3200.
+if [ ! -f "$DIR/App/.env" ]; then
+    PROD_URL=$(grep -E '^DATABASE_URL' "$HOME/pms/App/.env" | sed -E 's/^DATABASE_URL=//; s/^"//; s/"$//')
+    TEST_URL=$(printf '%s' "$PROD_URL" | sed -E "s#(@[^/]+/)pelagia([?]|\$)#\1pelagia_test\2#")
+    INV=$(grep -E '^NEXT_PUBLIC_INVENTORY_ENABLED' "$HOME/pms/App/.env" || echo 'NEXT_PUBLIC_INVENTORY_ENABLED=true')
+    SECRET=$(openssl rand -base64 32)
+    cat > "$DIR/App/.env" <<EOF
+# pms1 STAGING -- latest master against the prod-mirror test DB, safe dev mode.
+$INV
+NEXTAUTH_SECRET="$SECRET"
+NEXTAUTH_URL="http://localhost:$PORT"
+AZURE_AD_CLIENT_ID="dev-placeholder"
+AZURE_AD_CLIENT_SECRET="dev-placeholder"
+AZURE_AD_TENANT_ID="dev-placeholder"
+DATABASE_URL="$TEST_URL"
+GST_SERVICE_URL="http://localhost:3003"
+PORT=$PORT
+EOF
+    chmod 600 "$DIR/App/.env"
+fi
+
+# pm2-run wrapper so the dev server always gets nvm on PATH and the right port.
+cat > "$DIR/App/run-staging.sh" <<EOF
+#!/usr/bin/env bash
+export NVM_DIR="\$HOME/.nvm"; . "\$NVM_DIR/nvm.sh"
+cd "$DIR/App"
+exec pnpm dev -p $PORT
+EOF
+chmod +x "$DIR/App/run-staging.sh"
+
+cd "$DIR/App"
+echo "Installing deps..."; pnpm install --frozen-lockfile
+echo "Generating Prisma client..."; pnpm db:generate
+
+if pm2 describe "$NAME" >/dev/null 2>&1; then
+    pm2 restart "$NAME" --update-env
+else
+    pm2 start "$DIR/App/run-staging.sh" --name "$NAME" --interpreter bash
+fi
+pm2 save
+echo "Staging '$NAME' is up on port $PORT ($(git -C "$DIR" log --oneline -1))"