Add browser deploy recon backend with port scan, web crawl, and deploy lane recommendations.

POST /api/v1/recon/scan probes fleet ports from the server host, crawls owned HTTP targets, maps findings to spread lanes, and records optional oath ledger rows.

server/web/e2e/deploy-recon.spec.ts

@@ -0,0 +1,51 @@
+import { expect, test } from '@playwright/test';
+import { loginToDashboard } from './fixtures';
+
+const MOCK_REPORT = {
+  host: 'e2e-recon.lab',
+  scanned_at: '2026-06-07T12:00:00Z',
+  ports: [
+    { port: 22, open: false },
+    { port: 80, open: true },
+    { port: 445, open: true },
+    { port: 5985, open: false },
+  ],
+  crawl: {
+    pages_fetched: 1,
+    ssrf_score: 35,
+    url_fields: [{ page_url: 'http://e2e-recon.lab/', name: 'fetch_url', hint: 'url' }],
+    cms_fingerprints: ['wordpress'],
+    multipart_forms: [],
+  },
+  recommendations: [{ lane: 'spread_smb_unc', reason: 'SMB open', priority: 50 }],
+};
+
+test.describe('Deploy Recon smoke', () => {
+  test.beforeEach(async ({ page }) => {
+    await page.route('**/api/v1/recon/scan', async (route) => {
+      await route.fulfill({ json: MOCK_REPORT });
+    });
+    await loginToDashboard(page);
+    await page.goto('/deploy-recon');
+    await expect(page.getByRole('heading', { level: 1, name: /Deploy Recon/i })).toBeVisible({
+      timeout: 10_000,
+    });
+  });
+
+  test('sidebar link and scan results render', async ({ page }) => {
+    await page.getByTestId('dr-host-input').fill('e2e-recon.lab');
+    await page.getByTestId('dr-scan-btn').click();
+    await expect(page.getByTestId('dr-results')).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByTestId('dr-port-matrix')).toBeVisible();
+    await expect(page.getByTestId('dr-finding-ssrf')).toBeVisible();
+    await expect(page.getByRole('link', { name: /Fleet spread to e2e-recon\.lab/i })).toBeVisible();
+  });
+
+  test('/browser-spread alias redirects to deploy recon', async ({ page }) => {
+    await page.goto('/browser-spread');
+    await expect(page).toHaveURL(/\/deploy-recon/);
+    await expect(page.getByRole('heading', { level: 1, name: /Deploy Recon/i })).toBeVisible({
+      timeout: 10_000,
+    });
+  });
+});