fix: e2e QA hardening — honest runtime state, stable public ports, read-only anon UI (#12)

* fix: e2e QA hardening — honest runtime URLs, health, and read-only anon UI

Backend:
- managed DB provisioning: attach DB containers to the platform network and
  probe the container IP, fixing the 127.0.0.1 reachability failure inside
  the backend container; log provisioning failures
- stop fabricating connection URLs when provisioning produced none
- template deploys now carry port + health_check into service runtime fields
- service health probed over the project network (backend joins it) instead
  of an in-container wget that fails on shell-less images
- runtime/public/connection URLs rewrite loopback to the request Host so
  links are usable for LAN/remote clients

Frontend:
- service Networking panel shows real runtime URLs/ports/health instead of
  hardcoded containr.dev + 8080->443
- anonymous views hide all mutation controls (new project, add service,
  group, context menu)
- project cards: remove decorative svcN labels; badge says DOWN only when
  zero services run, IDLE when empty, DEGRADED for partial
- mobile projects header no longer clips (fluid search width)
- unknown routes render a not-found page instead of silently redirecting

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: telemetry scope label, chunk split, remove stale vite artifacts

- /system/host now reports scope=host|docker-desktop-vm and the daemon OS;
  Projects dashboard labels cards VM.* when the daemon is a Desktop VM so
  memory/core numbers aren't mistaken for physical host values
- manualChunks: split @xyflow/react and recharts out of the main bundle;
  removes the >1MB chunk warning
- drop tracked vite.config.js/.d.ts build artifacts that shadowed the real
  vite.config.ts

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: persist service host port; demo-data scope for telemetry

Public URLs were ephemeral: every restart/redeploy rebound a random host
port, so endpoint links rotted. Persist published_port on the service and
prefer it for replica 0 on create. If the port is taken, fall back to
ephemeral and repersist the new assignment. Post-start the binding is
verified — Docker Desktop accepts a conflicting publish silently, which
previously left services running with no endpoint at all.

demo-data.ts gains the required scope field for HostMonitoring (CI fix).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/frontend/src/features/workspace/canvas/ProjectCanvas.tsx

@@ -1099,15 +1099,17 @@ function CanvasInner({ projectId, services, variablesByService, onAddService, on
             ))}
           </div>
         )}
-        <button
-          type="button"
-          onClick={() => addGroup()}
-          className="canvas-pill canvas-pill-btn h-8 px-3 flex items-center gap-1.5 text-xs font-medium text-[var(--text-secondary)] hover:text-[var(--text-primary)]"
-          title="Add group"
-        >
-          <Layers size={13} />
-          Group
-        </button>
+        {!readOnly && (
+          <button
+            type="button"
+            onClick={() => addGroup()}
+            className="canvas-pill canvas-pill-btn h-8 px-3 flex items-center gap-1.5 text-xs font-medium text-[var(--text-secondary)] hover:text-[var(--text-primary)]"
+            title="Add group"
+          >
+            <Layers size={13} />
+            Group
+          </button>
+        )}
       </div>
 
       {/* Floating: zoom controls (bottom-left) */}
@@ -1170,15 +1172,17 @@ function CanvasInner({ projectId, services, variablesByService, onAddService, on
               Add a service from a git repo or Docker image - it runs on a private network with the rest of this
               project.
             </p>
-            <button
-              type="button"
-              onClick={onAddService}
-              className="inline-flex items-center gap-2 h-9 px-4 rounded-lg text-[var(--accent-on)] text-sm font-medium shadow-lg"
-              style={{ background: 'var(--accent-primary)' }}
-            >
-              <Plus size={15} />
-              Add Service
-            </button>
+            {!readOnly && (
+              <button
+                type="button"
+                onClick={onAddService}
+                className="inline-flex items-center gap-2 h-9 px-4 rounded-lg text-[var(--accent-on)] text-sm font-medium shadow-lg"
+                style={{ background: 'var(--accent-primary)' }}
+              >
+                <Plus size={15} />
+                Add Service
+              </button>
+            )}
           </div>
         </div>
       )}
@@ -1191,32 +1195,36 @@ function CanvasInner({ projectId, services, variablesByService, onAddService, on
         >
           {contextMenu.kind === 'pane' && (
             <>
-              <button
-                type="button"
-                onClick={() => {
-                  setContextMenu(null);
-                  onAddService();
-                }}
-                className="w-full flex items-center gap-2 px-3 py-1.5 text-xs text-[var(--text-secondary)] hover:bg-[var(--surface-muted)] hover:text-[var(--text-primary)] transition-colors"
-              >
-                <Plus size={13} />
-                Add service
-              </button>
-              <button
-                type="button"
-                onClick={() => {
-                  const at =
-                    contextMenu.flowX !== undefined && contextMenu.flowY !== undefined
-                      ? { x: contextMenu.flowX, y: contextMenu.flowY }
-                      : undefined;
-                  setContextMenu(null);
-                  addGroup(at);
-                }}
-                className="w-full flex items-center gap-2 px-3 py-1.5 text-xs text-[var(--text-secondary)] hover:bg-[var(--surface-muted)] hover:text-[var(--text-primary)] transition-colors"
-              >
-                <Layers size={13} />
-                Add group here
-              </button>
+              {!readOnly && (
+                <>
+                  <button
+                    type="button"
+                    onClick={() => {
+                      setContextMenu(null);
+                      onAddService();
+                    }}
+                    className="w-full flex items-center gap-2 px-3 py-1.5 text-xs text-[var(--text-secondary)] hover:bg-[var(--surface-muted)] hover:text-[var(--text-primary)] transition-colors"
+                  >
+                    <Plus size={13} />
+                    Add service
+                  </button>
+                  <button
+                    type="button"
+                    onClick={() => {
+                      const at =
+                        contextMenu.flowX !== undefined && contextMenu.flowY !== undefined
+                          ? { x: contextMenu.flowX, y: contextMenu.flowY }
+                          : undefined;
+                      setContextMenu(null);
+                      addGroup(at);
+                    }}
+                    className="w-full flex items-center gap-2 px-3 py-1.5 text-xs text-[var(--text-secondary)] hover:bg-[var(--surface-muted)] hover:text-[var(--text-primary)] transition-colors"
+                  >
+                    <Layers size={13} />
+                    Add group here
+                  </button>
+                </>
+              )}
               <div className="border-t border-[var(--border-subtle)] mt-1 pt-1">
                 <button
                   type="button"

app/frontend/src/features/workspace/pages/ProjectWorkspacePage.tsx

@@ -719,7 +719,7 @@ export function ProjectWorkspacePage() {
             <Search size={12} />
             <kbd className="px-1 py-0.5 rounded bg-[var(--surface-card)] text-[10px] font-mono">⌘K</kbd>
           </button>
-          {!isDemoMode && (
+          {!isDemoMode && signedIn && (
             <button
               onClick={openAddService}
               className="flex items-center gap-1.5 h-8 px-3 rounded-[var(--radius-md)] text-[var(--accent-on)] text-xs font-semibold shadow-lg hover:shadow-xl transition-all"
@@ -742,7 +742,7 @@ export function ProjectWorkspacePage() {
             onAddService={openAddService}
             onOpenService={(serviceId) => navigate(serviceHref(serviceId))}
             onOpenSection={(serviceId, section) => navigate(serviceSectionHref(serviceId, section))}
-            readOnly={isDemoMode}
+            readOnly={isDemoMode || !signedIn}
           />
           {isDemoMode && (
             <div className="absolute top-4 left-1/2 -translate-x-1/2 pointer-events-none">