ops: accept direct host isolation during internal verify

deploy/run-production-deploy.sh

@@ -241,6 +241,7 @@ for (const [role, key] of [
 }
 
 const internal = process.env.VERIFICATION_MODE === "internal";
+const expectedUserAdminStatus = internal ? 403 : 404;
 const request = (origin, path, options = {}) => {
   if (!internal) return fetch(`${origin}${path}`, options);
   return new Promise((resolve, reject) => {
@@ -298,8 +299,8 @@ for (let attempt = 1; attempt <= 12; attempt += 1) {
     };
     if (
       login.ok
-      && userAdminPage.status === 404
-      && userAdminApi.status === 404
+      && userAdminPage.status === expectedUserAdminStatus
+      && userAdminApi.status === expectedUserAdminStatus
       && adminPage.status === 307
       && adminPage.headers.get("location") === "/login"
       && adminApi.status === 401

frontend/tests/staging-backend-workflows.test.ts

@@ -990,6 +990,9 @@ test("production runner validates state and migrations before switching exact im
   assert.match(runner, /if \[ "\$VERIFICATION_MODE" = "public" \]/);
   assert.match(runner, /import http from "node:http"/);
   assert.match(runner, /http\.request\(\{[\s\S]*Host: new URL\(origin\)\.host/);
+  assert.match(runner, /expectedUserAdminStatus = internal \? 403 : 404/);
+  assert.match(runner, /userAdminPage\.status === expectedUserAdminStatus/);
+  assert.match(runner, /userAdminApi\.status === expectedUserAdminStatus/);
   assert.match(runner, /up -d --no-build api web/);
   assert.match(runner, /up -d --no-build --force-recreate --no-deps caddy/);
   assert.match(runner, /\["identity", "IDENTITY_DATABASE_URL"\]/);