feat(devops): add WAF smoke test and mounted Coraza config

[bihius]

Summary

• Mount Coraza SPOA config, Coraza directives, CRS setup, and CRS rules read-only into the compose service so local edits can be picked up with a service restart.
• Add a reproducible Docker Compose smoke test that asserts benign traffic returns 200 and SQL injection traffic returns 403 through HAProxy and Coraza.
• Add a separate nightly/manual GitHub Actions workflow for the smoke test and document local usage.

Test plan

• bash -n benchmarks/smoke/e2e.sh
• docker-compose -f deploy/docker/docker-compose.yml --env-file deploy/docker/.env config >/dev/null
• bash benchmarks/smoke/e2e.sh
• uv run pytest --cov=app
• uv run mypy app/
• uv run ruff check app/
• pnpm run type-check
• pnpm run lint
• pnpm run test
• docker run --rm -v "$PWD/configs/haproxy:/usr/local/etc/haproxy:ro" haproxy:3.0-alpine haproxy -c -f /usr/local/etc/haproxy/haproxy.cfg

Closes #7
Closes #108

[Copilot]

Pull request overview

This PR improves local and CI verification of the HAProxy + Coraza WAF datapath by (1) mounting Coraza configuration/rules into the Compose stack for easy iteration, and (2) adding an end-to-end smoke test (plus docs + a scheduled/manual GitHub Actions workflow) that asserts benign traffic is allowed and SQLi traffic is blocked.

Changes:

• Mount Coraza SPOA config, Coraza directives, CRS setup, and CRS rules read-only into the coraza Compose service.
• Add benchmarks/smoke/e2e.sh to stand up the Compose stack and assert 200 (benign) vs 403 (SQLi) through HAProxy+Coraza.
• Document smoke test usage and add a nightly/manual .github/workflows/smoke.yml workflow.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
deploy/docker/docker-compose.yml	Adds read-only mounts so Coraza loads host-side config/CRS on container restart.
configs/coraza/README.md	Documents the new Compose mount behaviour and how to reload Coraza.
benchmarks/smoke/e2e.sh	New smoke-test script that orchestrates Compose, waits for health, and validates 200/403 behaviour.
README.testing.md	Documents local prerequisites and how to run the E2E smoke test.
README.commands.md	Adds quick commands for restarting Coraza after config edits and running the smoke test.
.github/workflows/smoke.yml	Adds scheduled + manual GitHub Actions workflow to run the smoke test in CI.

[bihius]

@copilot apply changes based on this feedback

[Copilot]

Done in 7b24560. Two changes applied:

• Added SMOKE_PROJECT (defaulting to guard-proxy-smoke) and passed --project-name "${SMOKE_PROJECT}" to both the docker compose and docker-compose variants, so the smoke test always runs in an isolated project whose volumes are completely separate from a developer's default stack.
• Changed down -v to down -v || true so a cleanup failure cannot mask the original test exit status.