feat(2): Q3.3 lasuite-meet — install_steps (OIDC-at-install) + lifecycle overlays + health/OIDC parity tests

Mirrors lasuite-drive machinery (sibling La Suite recipe): install_steps.sh wires OIDC at install
(client_id from deps, scopes 'openid email'); ops.py + test_{install,upgrade,backup,restore}.py
lifecycle overlays (postgres meet/meet ci_marker data-integrity); functional/test_health_check.py
(parity) + test_oidc_with_keycloak.py (password-grant JWT vs dep keycloak, realm lasuite-meet-<6hex>).
§4.3 meeting_flow + webrtc specifics next (after install+OIDC validated). No setup_custom_tests.sh
(no post-deploy step — OIDC at install, no minio/collabora).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/lasuite-meet/test_install.py

@@ -0,0 +1,41 @@
+"""lasuite-meet — INSTALL overlay (Phase 1d, DG4): override + extend-by-composition.
+
+Reuses the generic "really serving" assertion, then ADDS recipe-specific checks: the stack serves
+over real HTTPS through the gateway, and a real browser loads the live Meet frontend (the SPA shell).
+Login is OIDC-gated (the SSO flow is exercised by the functional tests), so the install assertion is
+that the frontend SPA is served (unauthenticated landing), not an authenticated flow. Assertion-only
+on the shared deployment."""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import browser as harness_browser, generic, lifecycle  # noqa: E402
+
+
+def test_serving_and_frontend(live_app, meta):
+    # extend-by-composition: reuse the generic "really serving" assertion first ...
+    generic.assert_serving(live_app, meta)
+
+    # ... then the recipe-specific assertions.
+    status = lifecycle.http_get(live_app, "/")
+    assert status in (200, 301, 302), f"expected 2xx/3xx from {live_app}, got {status}"
+
+    # A real browser loads the live Meet frontend (the SPA shell) over HTTPS.
+    from playwright.sync_api import sync_playwright
+
+    url = f"https://{live_app}/"
+    with sync_playwright() as p:
+        browser = p.chromium.launch(args=["--no-sandbox"])
+        try:
+            ctx = browser.new_context(ignore_https_errors=True)
+            page = ctx.new_page()
+            resp = harness_browser.goto_with_retry(
+                page, url, accept_statuses=(200, 301, 302), goto_timeout_ms=60_000
+            )
+            assert resp is not None and resp.status in (200, 301, 302), (
+                f"page status {resp and resp.status}"
+            )
+            assert "<html" in page.content().lower(), "no HTML served by the frontend"
+        finally:
+            browser.close()