chore(web): connected-flow smoke for the Tools, Resources and Prompts tabs

The web client had exactly one connected-flow smoke and it was the Apps
tab. `smoke:web:browser` proves the bundle boots and paints but never
connects; `smoke:web:app` / `smoke:web:elicit` connect but only drive the
Apps surface. So the three highest-traffic tabs were unexercised through
the prod bundle end to end — everything covering them (unit tests,
Storybook, the integration project) mocks or bypasses the prod server, so
a regression living only in the built bundle or in the prod Hono
backend's wiring of a tab passed all of them.

`scripts/smoke-web-tabs.mjs` drives all three against one server on one
browser launch (~5s added wall-clock): Tools runs `list_items` and
asserts its `structuredContent` section rendered (#1908), Resources reads
`events` with the template list asserted separately — `resources/list`
and `resources/templates/list` are different calls and either can fail
alone — and Prompts fetches the argument-less `simple_prompt`.

Every assertion is on a `data-*` attribute, never on copy, mirroring the
`data-app-status` precedent: each screen now carries a readiness contract
(`data-tool-count` / `data-call-status` and its Resources / Prompts
equivalents), tabulated in the web README and pinned by screen unit tests
so a rename fails loudly there rather than as an opaque timeout here.

The deep-link connect step is extracted to `lib/deep-link-connect.mjs`
rather than copied a third time. That matters because `parseDeepLink`
ignores a link it cannot validate rather than reporting one, so a drifted
copy fails as an opaque connect timeout in whichever smoke was not
updated. `smoke:web:elicit`'s hand-rolled copy is retired onto it.

Chromium-only and deliberately not in `ENGINE_SMOKES`: the engine tiers
exist for the MCP Apps sandbox's genuinely divergent primitives, and
these tabs are ordinary React and Mantine. Network, Protocol, Logs and
Tasks remain uncovered — a stated gap, not an oversight.

Closes #2148

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UL9retfvAXRgvi6EWk4SY4
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/lib/mcp-app-flow.mjs

@@ -30,6 +30,10 @@
 
 import { join } from "node:path";
 import { startAnnouncedChild } from "./announced-child.mjs";
+import {
+  buildConnectDeepLink,
+  connectViaDeepLink,
+} from "./deep-link-connect.mjs";
 import {
   ensureTestServers,
   testServerEntryPath,
@@ -116,6 +120,9 @@ export function encodeAppArgs(args) {
  * The deep link that connects, switches to the Apps tab, pre-selects the app
  * tool, and fires "Open App". `autoConnect`/`autoOpen` must equal the session
  * token (CSRF gate). Shape owned by clients/web/README.md#deep-link-auto-connect.
+ *
+ * The connect half comes from `deep-link-connect.mjs`, shared with every other
+ * browser smoke; only the three App params (#1859) are added here.
  */
 export function buildAppDeepLink({
   baseUrl,
@@ -125,8 +132,8 @@ export function buildAppDeepLink({
   appArgs = {},
 }) {
   return (
-    `${baseUrl}/?serverUrl=${encodeURIComponent(mcpUrl)}` +
-    `&transport=http&autoConnect=${token}&openApp=${appTool}` +
+    `${buildConnectDeepLink({ baseUrl, mcpUrl, token })}` +
+    `&openApp=${appTool}` +
     `&appArgs=${encodeAppArgs(appArgs)}&autoOpen=${token}`
   );
 }
@@ -171,32 +178,14 @@ export async function driveAppFlow({
   connectTimeoutMs = 45_000,
   readyTimeoutMs = 45_000,
 }) {
-  const response = await page.goto(url, {
-    waitUntil: "domcontentloaded",
-    timeout: gotoTimeoutMs,
+  // 1-2. Navigated, the deep link accepted by the token gate, and connected.
+  await connectViaDeepLink({
+    page,
+    url,
+    expectDeepLink,
+    gotoTimeoutMs,
+    connectTimeoutMs,
   });
-  if (!response || !response.ok()) {
-    throw new Error(
-      `GET / returned HTTP ${response ? response.status() : "no response"}`,
-    );
-  }
-
-  // 1. The deep link must be accepted (not rejected by the token gate).
-  if (expectDeepLink) {
-    const status = page.locator('[data-testid="connection-status"]');
-    await status.waitFor({ state: "attached", timeout: gotoTimeoutMs });
-    const deeplink = await status.getAttribute("data-deeplink");
-    if (deeplink !== "parsed") {
-      throw new Error(
-        `deep link was not accepted (data-deeplink="${deeplink}") — expected "parsed"`,
-      );
-    }
-  }
-
-  // 2. Connected to the test server.
-  await page
-    .locator('[data-testid="connection-status"][data-status="connected"]')
-    .waitFor({ state: "attached", timeout: connectTimeoutMs });
 
   // 3. The widget rendered inside the sandbox and completed its handshake.
   try {