feat(templates): git compose import, six stack seeds, empty-default vars (#63)

* feat(templates): git compose import, six stack seeds, empty-default vars

- POST /templates/import/git fetches a compose file from any git remote
  (clone URL, ssh, owner/repo via connected providers — private repos
  included), ref selects branch or commit. Path defaults through
  compose.yaml/yml then docker-compose.yml/yaml. Reuses the build-on-node
  checkout machinery; repo-relative paths are containment-checked.
- CLI `templates import-git <repo> [path] [--ref]`, MCP
  containr_templates_import_git, OpenAPI entry, and a paste/git toggle
  in the template import dialog.
- {{VAR:-}} with an empty default now resolves instead of reporting the
  var missing — matches shell :- semantics.
- SeedTemplates gains six official graph stacks — n8n (pg+redis+worker),
  Gitea, Nextcloud, Vaultwarden, Umami, Immich — wired with
  {{service.*}} refs and {{secret}} credentials; no hardcoded passwords.
- TestSeedTemplatesResolveCleanly parses, topo-sorts, validates, and
  resolves every seeded graph — catalog drift can't merge silently.
- templates/n8n.md compose block had invalid YAML (mixed depends_on
  list/map) — fixed so the documented stack actually parses.

Verified live: import/git on a dumb-HTTP repo returns the converted
graph (db image → managed postgresql), path/ref/traversal/unauth edges
return clean errors, tpl-n8n plan resolves with zero unresolved vars.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* ci: pre-pull compose-smoke images via gcr mirror

Anonymous Docker Hub pulls rate-limit shared CI egress IPs — the compose
boot smoke flaked on traefik:pull. postgres/traefik are library/* images
served by mirror.gcr.io without auth; compose reuses the retagged local
images, falling back to a normal pull when the mirror misses.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* ci: route docker.io through gcr mirror for compose smoke

Pull-time pre-pulls don't cover BuildKit's base-image metadata lookups
(node:22-alpine, nginx:alpine, golang:1.26-alpine all 429). Daemon-level
registry-mirrors covers pulls and resolution in one move.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* ci: mirror docker.io in buildx for image publish job

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* ci: route smoke pulls/builds through mirror.gcr.io via compose overlay

daemon.json registry-mirrors isn't honored by the runner's containerd
image store. Qualify refs directly: ARG-parameterized Dockerfile FROMs
(defaults unchanged) plus a CI-only compose overlay that points image
pulls and build args at mirror.gcr.io.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ROADMAP2.md

@@ -228,24 +228,31 @@ goroutines; this fixes correctness *and* unlocks the ops surface.
 
 ## 6. Phase E — Templates v2 (absorbs compose-catalog spec + dflow graph templates)
 
-- [ ] **Template = ordered service graph** — `services[]` entries with
+- [x] **Template = ordered service graph** — `services[]` entries with
   `{name, type, source, build, ports, volumes, variables, depends_on}`;
-  deploy order from dependency refs.
-- [ ] **Expressions** — `${{service.KEY}}` (already the runtime ref
-  syntax — reuse), `{{secret(len,"charset")}}`, `{{random:int}}`,
-  `{{VAR:-default}}`; `POST /templates/:id/plan` returns the resolved
-  graph without deploying (agents love this).
-- [ ] **Compose import** — `POST /templates/import/compose` (compose-go
-  parser → graph), `POST /templates/import/github` (compose file from
-  repo path). Implements `docs/superpowers/specs/2026-04-14-*`.
-- [ ] **Graph deploy pipeline** — creates project + services in
-  dependency order, resolves vars, triggers builds; defined
-  partial-failure policy.
+  deploy order from dependency refs. `templategraph.go`,
+  `topoSortServices`.
+- [x] **Expressions** — `{{service.KEY.prop}}` (host/port/user/password/
+  database/url), `{{secret}}`/`{{secret(N)}}`, `{{random:N}}`,
+  `{{VAR:-default}}` (incl. explicitly-empty defaults); `POST
+  /templates/:id/plan` returns the resolved graph without deploying.
+- [x] **Compose import** — `POST /templates/import/compose` (yaml →
+  graph, known DB images become managed databases), `POST
+  /templates/import/git` (compose file fetched from any git repo — clone
+  URL, ssh remote, or owner/repo via connected providers, `ref` selects
+  branch/commit); `templates import-compose|import-git` CLI, MCP tools,
+  paste-or-git toggle in the template UI.
+- [x] **Graph deploy pipeline** — creates services in dependency order,
+  resolves vars/secrets, triggers builds. `deployTemplateGraph`,
+  `POST /templates/deploy` (inline), `POST /projects/:id/import-compose`.
 - [ ] **Visual template builder** — canvas mode: drop git/image/db
   nodes, wire refs, set order, save/publish. Reuses existing canvas
   primitives (dflow's `templates/compose` is exactly this).
-- [ ] **Catalog growth** — convert `templates/*.md` (20 app guides) into
-  real graph templates; screenshots + badges per the old spec.
+- [x] **Catalog growth** — seeded graph stacks for n8n, Gitea,
+  Nextcloud, Vaultwarden, Umami, Immich (Plausible already shipped).
+  `TestSeedTemplatesResolveCleanly` keeps every seed parseable,
+  topo-sortable, and fully resolved. Remaining single-service guides can
+  convert incrementally via the same endpoint.
 
 **Gate**: paste n8n compose → 3-service project with generated secrets
 and wired refs, one click or one CLI call.