fix(report): stop listing reports via PostgREST JSON paths (BUG-574)

Staging PostgREST rejects the executiveSummary JSON-path alias, so GET /api/reports 500s. Persist a plain card_summary column from the Markdown excerpt instead.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/operations/personal-report-staging.md

@@ -116,6 +116,20 @@ curl -sS -o /dev/null -w '%{http_code}\n' https://staging.jyotisha.chat/api/repo
 
 Expected logged-out status is `401`. Authenticated owner/non-owner checks must be performed in the browser or with ephemeral local credentials that are never pasted into logs.
 
+### Post-deploy report list / detail / create smoke (required)
+
+Apply `20260907010000_personal_report_card_summary.sql` before deploying application code that selects `personal_reports.card_summary`. After `/api/health` shows the target SHA, use a real logged-in staging session (do not paste cookies, JWTs, or birth data):
+
+1. `GET /api/reports` → **200** with `{ reports: [...] }`. Missing `cardSummary` on old rows is success, not an error. Must not return `report_generation_failed`.
+2. `GET /api/reports/<existing-id>` → **200** for an owned report (regression: list 500 while detail 200 was the 2026-09-07 incident).
+3. `POST /api/reports` create one new longform report, then poll until `status=ready` (about 10–30s). Confirm:
+   - detail page TOC and wide tables render from Markdown
+   - export downloads `.md`
+   - billing settles `inputTokens=0 outputTokens=0` on the catalog model
+   - the new list card shows `cardSummary` from the Markdown 摘要 excerpt
+
+Do not record report bodies, birth facts, user ids, or tokens in the smoke log. Record only HTTP status, `status=ready` latency band, and whether `cardSummary` was present.
+
 On the host, confirm no product PDF browser runtime exists:
 
 ```bash