ci(deploy): use ::error:: annotations for smoke-test failures

Convert the two bare failure echoes (gateway detection, /actuator status) to
::error:: so Gitea renders them as CI log annotations, consistent with the rest
of the deploy steps. No behaviour change. Raised in review (Leonie).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/actions/deploy-obs/action.yml

@@ -82,8 +82,9 @@ runs:
       # required keys before containers start. Catches undefined variables and
       # YAML errors in config files updated by the previous step.
       # --env-file order: obs.env first (git-tracked defaults), obs-secrets.env
-      # second (CI-written secrets). Later files win on duplicate keys, so
-      # obs-secrets.env overrides POSTGRES_HOST set in obs.env.
+      # second (CI-written secrets). Later files win on duplicate keys. POSTGRES_HOST
+      # is environment-specific and supplied only by obs-secrets.env — obs.env
+      # documents it but deliberately does not set a value.
       run: |
         docker compose \
           -f /opt/familienarchiv/docker-compose.observability.yml \

.gitea/actions/smoke-test/action.yml

@@ -39,7 +39,7 @@ runs:
         set -e
         URL="https://$HOST"
         HOST_IP=$(awk 'NR>1 && $2=="00000000"{h=$3;printf "%d.%d.%d.%d\n",strtonum("0x"substr(h,7,2)),strtonum("0x"substr(h,5,2)),strtonum("0x"substr(h,3,2)),strtonum("0x"substr(h,1,2));exit}' /proc/net/route)
-        [ -n "$HOST_IP" ] || { echo "ERROR: could not detect Docker bridge gateway via /proc/net/route"; exit 1; }
+        [ -n "$HOST_IP" ] || { echo "::error::could not detect Docker bridge gateway via /proc/net/route"; exit 1; }
         RESOLVE=(--resolve "$HOST:443:$HOST_IP")
         echo "Smoke test: $URL (pinned to $HOST_IP via bridge gateway)"
         curl -fsS "${RESOLVE[@]}" --max-time 10 "$URL/login" -o /dev/null
@@ -54,5 +54,5 @@ runs:
         curl -fsS "${RESOLVE[@]}" --max-time 10 -I "$URL/" \
           | grep -Eqi 'permissions-policy:[[:space:]]*camera=\(\),[[:space:]]*microphone=\(\),[[:space:]]*geolocation=\(\)'
         status=$(curl -s "${RESOLVE[@]}" -o /dev/null -w "%{http_code}" --max-time 10 "$URL/actuator/health")
-        [ "$status" = "404" ] || { echo "expected 404 from /actuator/health, got $status"; exit 1; }
+        [ "$status" = "404" ] || { echo "::error::expected 404 from /actuator/health, got $status"; exit 1; }
         echo "All smoke checks passed"