diff --git a/fallow.toml b/fallow.toml
new file mode 100644
index 00000000..105dffc2
--- /dev/null
+++ b/fallow.toml
@@ -0,0 +1,21 @@
+# Fallow audit config — entry-point overrides for the test scaffolding
+# introduced by port/quality-assets. Without these, fallow's static
+# analysis can't trace Playwright testDir and Vitest setupFiles as
+# entry points (both are framework-injected, not Nuxt-imported) and
+# false-positives every new file as unused.
+#
+# Husky pre-commit invokes fallow with `gate = "new-only"` (default);
+# `ignorePatterns` keeps the audit focused on the affected subdir while
+# excluding tooling configuration that's known to be portable.
+ignorePatterns = [
+  "server/test/**",
+  "fallow.toml",
+  ".fallow/**",
+]
+
+# @playwright/test only runs in the Playwright test runner (not loaded by
+# Nuxt at runtime). Confirmed in server/package.json as devDependencies;
+# fallow flags it as `unlisted_dependencies` because server/playwright.config.ts
+# imports it from outside the test/ ignorePattern. Promote to ignored
+# rather than promote to runtime dependencies.
+ignoreDependencies = ["@playwright/test"]
diff --git a/server/test/e2e/smoke.spec.ts b/server/test/e2e/smoke.spec.ts
new file mode 100644
index 00000000..2f46e2bf
--- /dev/null
+++ b/server/test/e2e/smoke.spec.ts
@@ -0,0 +1,30 @@
+import { test, expect } from "@playwright/test";
+
+// Smoke spec — exists to unblock CI. Playwright's test runner exits 1 when
+// no tests match the testDir glob; this single spec keeps the green-rail
+// stable for port/quality-assets. Phase 2 (separate PR) adds the real
+// auth-flow + game-library E2E suite (see hyperplan bundle I3 — desktop
+// is out of scope, web is the target).
+//
+// What this covers:
+//   - Nuxt SSR Nitro stack reachable (port 4000, dev server)
+//   - Root route resolves to either 200 (auth'd landing) or 3xx redirect
+//     to /auth/login — the auth-gated baseline. No DB deps required
+//     for routing itself; DB deps hit the integration suite, not smoke.
+test("app root loads or redirects to /auth/login", async ({ page }) => {
+  const response = await page.goto("/");
+  expect(response, "navigated to / should produce a response").not.toBeNull();
+  const status = response!.status();
+  expect(status, "expected 2xx / 3xx from root route").toBeGreaterThanOrEqual(
+    200,
+  );
+  expect(status, "expected < 400 from root route").toBeLessThan(400);
+  // After load, URL should be either root (auth'd) or /auth/login (unauth'd).
+  const finalUrl = page.url();
+  const isRoot = new URL(finalUrl).pathname === "/";
+  const isLogin = new URL(finalUrl).pathname.startsWith("/auth");
+  expect(
+    isRoot || isLogin,
+    `expected root or /auth/* path, got ${finalUrl}`,
+  ).toBe(true);
+});
diff --git a/server/test/setup.ts b/server/test/setup.ts
new file mode 100644
index 00000000..99614979
--- /dev/null
+++ b/server/test/setup.ts
@@ -0,0 +1,11 @@
+// Vitest setup file — referenced by vitest.config.ts as setupFiles.
+// Exists to unblock `pnpm --filter drop test` even when there are zero
+// test files in the repo (Vitest still loads setup before --passWithNoTests).
+//
+// Sets DATABASE_URL to the docker-compose.test.yml postgres (port 5433)
+// so any Phase-2 test that hits Prisma has a datasource to connect to.
+// Vitest's env-isolation: this file runs per-worker due to `pool: "forks"`.
+
+process.env.DATABASE_URL ??=
+  "postgresql://drop_test:drop_test@localhost:5433/drop_test";
+process.env.NODE_ENV ??= "test";