Overhaul: real metrics, Git integration UI, open-source hygiene, root cleanup

Backend:
- GET /services/:id/metrics with real Docker container stats
- DELETE /git/providers/:id and GET repo branches endpoint

Frontend:
- Service detail shows real telemetry or honest empty states
- Live status distinguishes idle/polling/reconnecting
- Git providers section in Settings; repo+branch pickers in Add Service
- Real logo, compact Projects header, canvas fitView fix
- index.css deduplicated (1725 -> 1384 lines)
- Fixed smoke tests, lint errors, ToastProvider/context unification

Repo hygiene:
- Added LICENSE (MIT), CONTRIBUTING.md, SECURITY.md; rewrote README
- Untracked .env.prod and data/letsencrypt secrets; fixed .gitignore
- Removed legacy root src/internal/cmd and stale configs/docs/artifacts
- Moved guides and design references under docs/

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/superpowers/specs/2026-04-16-containr-auth-shell-design.md

@@ -0,0 +1,69 @@
+# Containr Auth And Shell Design
+
+Date: 2026-04-16
+
+## Scope
+
+Change only `app/frontend` and `app/backend`. Leave legacy root `src/` frontend untouched.
+
+## Auth
+
+Containr uses embedded Better Auth for cookie sessions. Public auth supports only:
+
+- Email/password
+- GitHub OAuth
+- Google OAuth
+
+Magic links, GitLab, Bitbucket, and Gitea auth are removed from active auth UI and runtime config.
+
+Bootstrap behavior:
+
+- If no local platform users exist, auth UI sends users to first-account registration.
+- If at least one local platform user exists, public registration is disabled.
+- Existing users can sign in only.
+- New users after bootstrap must be created manually inside authenticated platform UI/API.
+
+Backend enforcement:
+
+- Better Auth blocks user creation after bootstrap unless request carries trusted internal token.
+- Go API exposes bootstrap status.
+- Go API exposes authenticated manual user creation. It creates both Better Auth credentials and local platform user.
+
+## Shell
+
+Desktop sidebar becomes expanded, non-scrollable, and label-first. Primary items:
+
+- Projects
+- Templates
+- Usage
+- People
+- Settings
+- Docs
+
+Bottom area keeps account access and settings/sign-out. Top logo placeholder links to `/projects`. Support is removed.
+
+## Upgrade
+
+Upgrade control becomes functional. Backend exposes current image/ref status and a pull operation for configured GitHub Container Registry or Docker image refs. Frontend can auto-detect configured image and trigger pull.
+
+## Notifications
+
+Notifications menu shows live operational data from existing build/audit APIs with refresh. It no longer acts as static decoration.
+
+## Theme
+
+Add light mode support by toggling root theme attribute and CSS variables. Keep current dark palette as default.
+
+## Task 7: Host Monitoring And Agents
+
+Add backend/frontend foundation for host telemetry and distributed nodes:
+
+- Monitor server running Containr.
+- Store/surface CPU, memory, disk, load, uptime, Docker availability, and node health.
+- Reuse existing node agent routes where possible.
+- Allow connecting additional VPS, LXC, VM, or bare-metal nodes through agent registration.
+- Expose data needed later by autoscaling and distributed placement.
+
+## Validation
+
+Run frontend typecheck/build for `app/frontend`. Run focused Go tests or `go test ./internal/api/... ./internal/middleware/...` from `app/backend` where feasible.