fix(smoke): install node-service host deps + pin api to 1 replica in farm-smoke override

[sssaturX]

Problem

CI's Smoke (offline / PR) job fails with two successive issues:

1. First failure — Cannot find module 'ioredis' in node-service/scripts/seed-mms-redis.cjs. The smoke shell script runs .cjs helpers on the host out of node-service/, needing ioredis / nats / ws / jsonwebtoken from node_modules. The CI job never ran npm ci in node-service/.
2. Second failure (revealed once deps are installed) — Bind for 127.0.0.1:13000 failed: port is already allocated. The base docker-compose.yml declares api.deploy.replicas: 3 (production shape) but the smoke override publishes a fixed host port 13000. Only one container can bind it; replica main commit #2 aborts.

Fix

Three independent changes, all scoped to smoke-only config:

1. Install node-service host deps before running .cjs helpers

Shell scripts (scripts/docker-smoke-mms-{offline,live}.sh) get an ensure_node_service_deps guard that runs npm ci --no-audit --no-fund --prefer-offline in node-service/ only if any of ioredis / nats / ws / jsonwebtoken is missing. Fixes local reproduction too.

CI workflows (.github/workflows/ci.yml offline job and smoke-mms-live-nightly.yml) add actions/setup-node@v4 + explicit npm ci in node-service/ before the smoke step. Cache is warm across runs.

2. Pin api to 1 replica in the smoke override

docker-compose.farm-smoke-override.yml adds deploy.replicas: 1 on the api service. Compose deep-merges deploy, so the base deploy.resources block is preserved; production compose is untouched.

api:
  deploy:
    replicas: 1
  ports:
    - "127.0.0.1:13000:3000"

Verification

• yaml.safe_load on both workflow files and the compose override — clean.
• bash -n on both smoke scripts — clean.
• CI run on this branch: green — Smoke (offline / PR) passes in 2m09s (gh run view 24861008276), together with node-service, ws-service, farm-spa, market-microstructure-service.
• Host-side .cjs deps audited against every file in node-service/scripts/*.cjs:
  • ioredis — seed-mms-redis.cjs
  • nats — mms-offline-prove.cjs
  • ws — mms-offline-prove.cjs, ws-mms-smoke.cjs
  • jsonwebtoken — inline node -e JWT sign in both smoke scripts

No production-path changes. This PR supersedes #28 (which carried only the replica fix).