test: extend smoke.sh with portal-frontend checks

Container count is now 10; adds checks that /portal/ and a direct
deep link both serve the Angular app (200) through the proxy,
proving both the routing wiring and the container's SPA fallback.
Full smoke run verified green on a fresh stack.

scripts/smoke.sh

@@ -37,7 +37,7 @@ for line in sys.stdin:
         print(f'{svc}: health={health}'); ok = False
 print('ALL_OK' if ok else 'SOME_FAILED')
 ")
-if echo "$STATUS" | grep -q ALL_OK; then pass "all 9 containers running/healthy"; else fail "container status: $STATUS"; fi
+if echo "$STATUS" | grep -q ALL_OK; then pass "all 10 containers running/healthy"; else fail "container status: $STATUS"; fi
 
 if curl -sS --max-time 2 http://localhost:8081 >/dev/null 2>&1; then
   fail "legacy-backend must NOT be reachable from the host (port 8081 responded)"
@@ -50,6 +50,13 @@ else
   pass "case-framework not reachable from host"
 fi
 
+echo "== Portal frontend (Session 2) =="
+
+HTTP=$(curl -sS -o /dev/null -w '%{http_code}' "$BASE/portal/")
+check_status "GET /portal/ serves the Angular app" "200" "$HTTP"
+HTTP=$(curl -sS -o /dev/null -w '%{http_code}' "$BASE/portal/legacy/1001")
+check_status "deep link /portal/legacy/1001 falls back to index.html" "200" "$HTTP"
+
 echo "== Seam A: unified read =="
 
 WORKLIST=$(curl -sS "$BASE/api/worklist")