Overhaul: real metrics, Git integration UI, open-source hygiene, root cleanup

Backend:
- GET /services/:id/metrics with real Docker container stats
- DELETE /git/providers/:id and GET repo branches endpoint

Frontend:
- Service detail shows real telemetry or honest empty states
- Live status distinguishes idle/polling/reconnecting
- Git providers section in Settings; repo+branch pickers in Add Service
- Real logo, compact Projects header, canvas fitView fix
- index.css deduplicated (1725 -> 1384 lines)
- Fixed smoke tests, lint errors, ToastProvider/context unification

Repo hygiene:
- Added LICENSE (MIT), CONTRIBUTING.md, SECURITY.md; rewrote README
- Untracked .env.prod and data/letsencrypt secrets; fixed .gitignore
- Removed legacy root src/internal/cmd and stale configs/docs/artifacts
- Moved guides and design references under docs/

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/config/config_test.go

@@ -12,9 +12,14 @@ func TestLoadUsesCORSAllowedOriginsAlias(t *testing.T) {
 	t.Setenv("CORS_ALLOWED_ORIGINS", "http://localhost:3000,https://app.example.com")
 
 	cfg := Load()
-	want := []string{"http://localhost:3000", "https://app.example.com"}
-	if !reflect.DeepEqual(cfg.CORSOrigins, want) {
-		t.Fatalf("unexpected CORS origins: got %v want %v", cfg.CORSOrigins, want)
+	if !containsAll(cfg.CORSOrigins, []string{
+		"http://localhost:3000",
+		"http://localhost:5173",
+		"http://localhost:5174",
+		"http://127.0.0.1:5174",
+		"https://app.example.com",
+	}) {
+		t.Fatalf("unexpected CORS origins: got %v", cfg.CORSOrigins)
 	}
 }
 
@@ -180,3 +185,27 @@ func TestLoadUsesNewStartupDefaults(t *testing.T) {
 		t.Fatalf("expected positive MAX_REQUEST_BODY_BYTES, got %d", cfg.MaxRequestBody)
 	}
 }
+
+func TestLoadDoesNotExpandNonLocalDevelopmentCORSOrigins(t *testing.T) {
+	t.Setenv("ENVIRONMENT", "development")
+	t.Setenv("CORS_ORIGINS", "https://preferred.example.com")
+
+	cfg := Load()
+	want := []string{"https://preferred.example.com"}
+	if !reflect.DeepEqual(cfg.CORSOrigins, want) {
+		t.Fatalf("unexpected CORS origins: got %v want %v", cfg.CORSOrigins, want)
+	}
+}
+
+func containsAll(haystack []string, needles []string) bool {
+	seen := make(map[string]struct{}, len(haystack))
+	for _, item := range haystack {
+		seen[item] = struct{}{}
+	}
+	for _, needle := range needles {
+		if _, ok := seen[needle]; !ok {
+			return false
+		}
+	}
+	return true
+}