fix: close release preflight gaps

Route public health checks to the API, backfill and synchronize job opportunities, stabilize SPA smoke tests, and document operator-only production steps.

job-tracker-ui/app/[[...slug]]/page.tsx

@@ -1,15 +0,0 @@
-import ClientShell from "./ClientShell";
-
-// Optional catch-all so EVERY path (/, /cv/{slug}, /career/builder/…) resolves to this same shell on
-// a hard load. Without it, `output: export` only generates `/`, and Next's client renders its
-// not-found for any deep URL before React Router can route it — breaking refresh and shared links.
-// generateStaticParams emits just index.html (the empty slug); nginx (try_files $uri /index.html)
-// serves that shell for every unknown path, and this catch-all matches it client-side so React
-// Router takes over. See docs/architecture/frontend.md (SPA routing).
-export function generateStaticParams() {
-  return [{ slug: [] }];
-}
-
-export default function Page() {
-  return <ClientShell />;
-}

job-tracker-ui/app/page.tsx

@@ -0,0 +1,5 @@
+import ClientShell from "./[[...slug]]/ClientShell";
+
+export default function Page() {
+  return <ClientShell />;
+}

job-tracker-ui/next.config.js

@@ -2,9 +2,14 @@
 const nextConfig = {
   // The whole app is client-rendered React Router behind auth (see app/page.tsx) -- static
   // export keeps the same "one index.html + JS bundle, served by nginx" deploy as CRA had.
-  // `next dev` cannot generate arbitrary optional-catch-all paths under static-export mode.
+  // Development mirrors nginx's SPA fallback with a rewrite to the root shell.
   output: process.env.NODE_ENV === "development" ? undefined : "export",
   reactStrictMode: true,
+  ...(process.env.NODE_ENV === "development" && {
+    async rewrites() {
+      return [{ source: "/:path*", destination: "/" }];
+    },
+  }),
 };
 
 module.exports = nextConfig;

job-tracker-ui/nginx.conf

@@ -14,6 +14,16 @@ server {
     try_files $uri /index.html;
   }
 
+  location = /health {
+    proxy_pass http://backend:8080/health;
+    proxy_http_version 1.1;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+
   location /api/ {
     proxy_pass http://backend:8080;
     proxy_http_version 1.1;

job-tracker-ui/src/nginx-config.test.ts

@@ -0,0 +1,8 @@
+import fs from "node:fs";
+import path from "node:path";
+
+test("public health reaches the backend instead of the SPA fallback", () => {
+  const config = fs.readFileSync(path.join(process.cwd(), "nginx.conf"), "utf8");
+
+  expect(config).toMatch(/location = \/health\s*{[^}]*proxy_pass http:\/\/backend:8080\/health;/s);
+});