ce9679b671
The deploy API's 202 pointed at a route that did not exist. The GET reads the deployment (projected, no artifact blob) and its per-node apply states, and carries the POST's own gate: API key in X-Api-Key, AllowAnonymous against the cookie fallback, 503 while Security:DeployApiKey is unset. Refs #745 Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT