fix(smoke): support separate actuator target

[ShinyHero666]

Summary

• Split the public application target from the Actuator target via ACTUATOR_BASE_URL, while preserving the current single-URL default.
• Validate that health responses are Actuator JSON and reject HTML SPA fallbacks as routing/target errors.
• Keep the Prometheus anonymous-access assertion on the actual Actuator target and reject HTML responses.
• Extend script-level regression coverage for split targets and the HTML fallback failure case.
• Document local/Compose, staging, and ingress usage.

Validation

• Backend tests passed (not applicable: shell/docs-only change)
• Frontend typecheck/build passed (not applicable: no frontend source changes)
• OpenAPI SDK regenerated or checked when API contracts changed (no API contract changes)
• Smoke test run when relevant

Commands run:

bash -n scripts/smoke-test.sh
bash -n scripts/tests/smoke-test-admin-mode-test.sh
bash scripts/tests/smoke-test-admin-mode-test.sh
git diff --check

Risk

• User-facing impact: smoke tests can now target private Actuator endpoints independently and no longer accept an HTML SPA fallback as health.
• Deployment or migration impact: none; ACTUATOR_BASE_URL defaults to the existing public/API target.
• Rollback approach: revert this commit to restore single-target status-only checks.

Notes

• Related issue: Fixes test(smoke): support deployments where actuator endpoints are not exposed by the public ingress #627
• Follow-up work: none
• Docs or operator runbooks updated when behavior changed: README smoke-test instructions updated.

[CLAassistant]

All committers have signed the CLA.

[FenjuFu]

Reviewed the split-target behavior and regression coverage. ACTUATOR_BASE_URL preserves the existing default, both Actuator probes use the private target when configured, HTML SPA fallbacks are rejected, and the application API checks remain on BASE_URL. The focused shell tests plus full CI, DCO, and CLA are green. No blocking issues found.