M6.5: enroll cryptpad (recipe #3, stateful/no-DB) + generic per-recipe EXTRA_ENV

Adds a shared-harness EXTRA_ENV mechanism (recipe_meta.py dict or domain-callable),
applied in deploy_app at every deploy path — no per-recipe harness surgery (D5).
cryptpad uses it for its required distinct SANDBOX_DOMAIN. Tests assert data
survival via a marker file in the backed-up cryptpad_data volume (exec_in_app,
since cryptpad data isn't HTTP-served).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/cryptpad/test_install.py

@@ -0,0 +1,30 @@
+"""cryptpad — install stage (recipe #3, stateful/no-DB). D2 install + D3 Playwright."""
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import lifecycle  # noqa: E402
+
+
+def test_http_reachable(deployed_app):
+    """cryptpad answers over real HTTPS through the gateway (nginx -> cryptpad app)."""
+    status = lifecycle.http_get(deployed_app, "/")
+    assert status in (200, 301, 302), f"expected 2xx/3xx from {deployed_app}, got {status}"
+
+
+def test_playwright_loads_cryptpad(deployed_app):
+    """A real browser loads the live cryptpad landing page and sees its served app."""
+    from playwright.sync_api import sync_playwright
+
+    url = f"https://{deployed_app}/"
+    with sync_playwright() as p:
+        browser = p.chromium.launch(args=["--no-sandbox"])
+        try:
+            ctx = browser.new_context(ignore_https_errors=True)
+            page = ctx.new_page()
+            resp = page.goto(url, wait_until="load", timeout=60000)
+            assert resp is not None and resp.status in (200, 304), f"page status {resp and resp.status}"
+            body = page.content().lower()
+            assert "cryptpad" in body or "<html" in body, "no cryptpad content served"
+        finally:
+            browser.close()