Overhaul: real metrics, Git integration UI, open-source hygiene, root cleanup

Backend:
- GET /services/:id/metrics with real Docker container stats
- DELETE /git/providers/:id and GET repo branches endpoint

Frontend:
- Service detail shows real telemetry or honest empty states
- Live status distinguishes idle/polling/reconnecting
- Git providers section in Settings; repo+branch pickers in Add Service
- Real logo, compact Projects header, canvas fitView fix
- index.css deduplicated (1725 -> 1384 lines)
- Fixed smoke tests, lint errors, ToastProvider/context unification

Repo hygiene:
- Added LICENSE (MIT), CONTRIBUTING.md, SECURITY.md; rewrote README
- Untracked .env.prod and data/letsencrypt secrets; fixed .gitignore
- Removed legacy root src/internal/cmd and stale configs/docs/artifacts
- Moved guides and design references under docs/

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/api/auth_proxy.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"containr/internal/database"
 	"log"
 	"net/http"
 	"net/http/httputil"
@@ -12,7 +13,7 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-func setupAuthProxyRoutes(router *gin.Engine, cfg *config.Config) {
+func setupAuthProxyRoutes(router *gin.Engine, cfg *config.Config, db *database.DB) {
 	targetURL, err := parseAuthProxyTarget(cfg.BetterAuthProxyURL)
 	if err != nil {
 		log.Printf("Warning: auth proxy disabled: %v", err)
@@ -28,6 +29,12 @@ func setupAuthProxyRoutes(router *gin.Engine, cfg *config.Config) {
 	}
 
 	handler := func(c *gin.Context) {
+		if shouldBlockPublicBetterAuthSignup(c, cfg, db) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "Public registration is disabled after bootstrap"})
+			c.Abort()
+			return
+		}
+
 		proxy.ServeHTTP(c.Writer, c.Request)
 		c.Abort()
 	}
@@ -36,6 +43,33 @@ func setupAuthProxyRoutes(router *gin.Engine, cfg *config.Config) {
 	router.Any("/api/auth/*proxyPath", handler)
 }
 
+func shouldBlockPublicBetterAuthSignup(c *gin.Context, cfg *config.Config, db *database.DB) bool {
+	if db == nil || db.DB == nil {
+		return false
+	}
+
+	if !strings.EqualFold(c.Request.Method, http.MethodPost) {
+		return false
+	}
+
+	if !strings.HasSuffix(c.Request.URL.Path, "/sign-up/email") {
+		return false
+	}
+
+	internalToken := strings.TrimSpace(cfg.BetterAuthInternalToken)
+	if internalToken != "" && c.GetHeader("X-Containr-Auth-Internal") == internalToken {
+		return false
+	}
+
+	count, err := countLocalUsers(db)
+	if err != nil {
+		log.Printf("Failed to inspect signup bootstrap state: %v", err)
+		return true
+	}
+
+	return count > 0
+}
+
 func parseAuthProxyTarget(rawTarget string) (*url.URL, error) {
 	trimmed := strings.TrimSpace(rawTarget)
 	if trimmed == "" {