Add global recent-deployments feed for the projects dashboard

The RECENT DEPLOYMENTS section queried the builds table, so
image-sourced services — which deploy without building — never
appeared and the dashboard reported "no deployments yet" while
containers were running.

- GET /api/v1/deployments lists latest deployments across the
  caller's services, joined with service + project names, ordered
  newest-first with a bounded limit
- ProjectsPage consumes it via listRecentDeployments; the DEPLOYS
  stat card now counts real deployments
- is_admin is now projected in register/upsert user responses, and
  the Better Auth mirror grants admin to the first mirrored account
  (previously only the legacy register path did)

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/api/auth.go

@@ -256,17 +256,23 @@ func createLocalUserFromBetterAuth(db *database.DB, authUser betterAuthLoginUser
 		return User{}, err
 	}
 
+	// A mirrored first account owns the platform, same as handleRegister.
+	var total int
+	if err := db.QueryRow("SELECT COUNT(*) FROM users").Scan(&total); err != nil {
+		return User{}, err
+	}
+
 	var user User
 	err = db.QueryRow(`
-		INSERT INTO users (email, password_hash, name, avatar_url)
-		VALUES ($1, $2, $3, NULLIF($4, ''))
+		INSERT INTO users (email, password_hash, name, avatar_url, is_admin)
+		VALUES ($1, $2, $3, NULLIF($4, ''), $5)
 		ON CONFLICT (email) DO UPDATE
 		SET name = EXCLUDED.name,
 		    avatar_url = COALESCE(EXCLUDED.avatar_url, users.avatar_url),
 		    updated_at = NOW()
-		RETURNING id, email, name, COALESCE(avatar_url, ''), created_at
-	`, email, string(hashedPassword), name, strings.TrimSpace(authUser.Image)).
-		Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.CreatedAt)
+		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
+	`, email, string(hashedPassword), name, strings.TrimSpace(authUser.Image), total == 0).
+		Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
 	if err != nil {
 		return User{}, err
 	}
@@ -320,8 +326,8 @@ func handleRegister(c *gin.Context) {
 	err = db.QueryRow(`
 		INSERT INTO users (email, password_hash, name, is_admin)
 		VALUES ($1, $2, $3, $4)
-		RETURNING id, email, name, COALESCE(avatar_url, ''), created_at
-	`, req.Email, string(hashedPassword), req.Name, total == 0).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.CreatedAt)
+		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
+	`, req.Email, string(hashedPassword), req.Name, total == 0).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create user"})
@@ -388,8 +394,8 @@ func handleCreateUser(c *gin.Context) {
 	err = db.QueryRow(`
 		INSERT INTO users (email, password_hash, name)
 		VALUES ($1, $2, $3)
-		RETURNING id, email, name, COALESCE(avatar_url, ''), created_at
-	`, req.Email, string(hashedPassword), req.Name).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.CreatedAt)
+		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
+	`, req.Email, string(hashedPassword), req.Name).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
 	if err != nil {
 		c.JSON(http.StatusConflict, gin.H{"error": "User already exists"})
 		return

app/backend/internal/api/deployments.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"
 
@@ -120,6 +121,72 @@ func handleGetDeployments(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"deployments": deployments})
 }
 
+// RecentDeployment is a deployment row joined with its service and project names.
+type RecentDeployment struct {
+	ID          uuid.UUID  `json:"id"`
+	ServiceID   uuid.UUID  `json:"service_id"`
+	ServiceName string     `json:"service_name"`
+	ProjectName string     `json:"project_name"`
+	Status      string     `json:"status"`
+	ImageName   string     `json:"image_name"`
+	StartedAt   *time.Time `json:"started_at"`
+	CompletedAt *time.Time `json:"completed_at"`
+	CreatedAt   time.Time  `json:"created_at"`
+}
+
+// handleGetRecentDeployments lists the latest deployments across all of the
+// caller's services — feeds the dashboard deploy feed.
+func handleGetRecentDeployments(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	limit := 10
+	if v := c.Query("limit"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 50 {
+			limit = n
+		}
+	}
+
+	rows, err := db.(*database.DB).Query(
+		`SELECT d.id, d.service_id, s.name, p.name, d.status,
+		        COALESCE(d.image_name, ''), d.started_at, d.completed_at, d.created_at
+		 FROM deployments d
+		 JOIN services s ON s.id = d.service_id
+		 JOIN projects p ON p.id = s.project_id
+		 WHERE p.owner_id = $1
+		 ORDER BY d.created_at DESC
+		 LIMIT $2`,
+		userID.(string), limit,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve deployments"})
+		return
+	}
+	defer rows.Close()
+
+	deployments := []RecentDeployment{}
+	for rows.Next() {
+		var d RecentDeployment
+		if err := rows.Scan(&d.ID, &d.ServiceID, &d.ServiceName, &d.ProjectName,
+			&d.Status, &d.ImageName, &d.StartedAt, &d.CompletedAt, &d.CreatedAt); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan deployment"})
+			return
+		}
+		deployments = append(deployments, d)
+	}
+
+	c.JSON(http.StatusOK, gin.H{"deployments": deployments})
+}
+
 func handleCreateDeployment(c *gin.Context) {
 	db, exists := c.Get("db")
 	if !exists {

app/backend/internal/api/production_behavior_test.go

@@ -6,6 +6,8 @@ import (
 	"net/http/httptest"
 	"testing"
 
+	"containr/internal/database"
+
 	"github.com/gin-gonic/gin"
 )
 
@@ -86,3 +88,30 @@ func TestRequireAuthenticatedUserIDRejectsMissingUserContext(t *testing.T) {
 		t.Fatalf("expected status %d, got %d", http.StatusUnauthorized, rec.Code)
 	}
 }
+
+func TestRecentDeploymentsRequireAuthentication(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.GET("/api/v1/deployments", handleGetRecentDeployments)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/deployments", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// No db in context → dependency failure surfaces before auth.
+	if rec.Code != http.StatusInternalServerError {
+		t.Fatalf("expected status %d, got %d", http.StatusInternalServerError, rec.Code)
+	}
+
+	// With db present but no user context → 401.
+	router2 := gin.New()
+	router2.GET("/api/v1/deployments", func(c *gin.Context) {
+		c.Set("db", &database.DB{})
+		handleGetRecentDeployments(c)
+	})
+	rec2 := httptest.NewRecorder()
+	router2.ServeHTTP(rec2, httptest.NewRequest(http.MethodGet, "/api/v1/deployments", nil))
+	if rec2.Code != http.StatusUnauthorized {
+		t.Fatalf("expected status %d, got %d", http.StatusUnauthorized, rec2.Code)
+	}
+}

app/backend/internal/api/routes.go

@@ -219,6 +219,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			// Deployment routes
 			protected.GET("/services/:id/deployments", handleGetDeployments)
 			protected.POST("/services/:id/deployments", handleCreateDeployment)
+			protected.GET("/deployments", handleGetRecentDeployments)
 			protected.GET("/deployments/:id", handleGetDeployment)
 			protected.POST("/deployments/:id/rollback", handleRollbackDeployment)