feat(git-sources): harden create-from-git with LFS + submodule warnings (#609)

* feat(git-sources): surface LFS and submodule warnings on create

Creating a stack from a Git repo now detects two common anomalies and
tells the user about them rather than silently producing broken stacks.

- LFS-pointer compose/env files fail early with a clear error instead
  of writing a 130-byte pointer stub to disk as real content.
- Repositories containing .gitmodules produce a non-fatal warning so
  the user knows build contexts or volumes inside submodules will be
  empty at deploy time.

Also refines the create dialog: sr-only DialogDescription for a11y,
short commit SHA suffix on the success toast, env-path hint under the
"Sync .env" checkbox showing which path will be read, and a route-level
diagnostic log line gated on developer mode for support debugging.

* test(git-sources): cover LFS, submodule, and nested env_path paths

Adds unit coverage for the new LFS-pointer rejection and submodule
warning plumbing, plus a nested compose_path case that exercises the
default env_path resolution ("apps/web/compose.yaml" with sync_env on
and env_path unset writes "apps/web/.env" both to disk and to the DB).

Extends the E2E suite with a happy-path assertion that the full-length
commit SHA is returned in the create response, and a UI flow that
verifies the short-SHA suffix appears in the success toast.

* docs(git-sources): add troubleshooting for LFS, submodules, HTTPS-only

Adds troubleshooting entries for the newly surfaced LFS and submodule
anomalies, expands the clone-timeout entry with the bounded-fetch
explanation, and adds a dedicated HTTPS-only entry. Also consolidates
the known limitations into a single list covering LFS, submodules,
branch-tracking, and HTTPS-only.

* fix(settings): use Route icon for notification routing

The routing section in Settings previously used GitBranch, which now
clashes with the Git Source feature's icon across the editor. Switch
to Route (a branching-flow glyph) so routing rules have a distinct
visual identity and aren't visually conflated with Git-backed stacks.

* fix(git-sources): return 400 for upstream auth failures and disambiguate 404s

Upstream git-host auth failures were mapping to HTTP 401, which the frontend
apiFetch treats as a Sencho session expiry and fires the global logout event.
They now return 400 with code=AUTH_FAILED in the body so the UI can branch on
the discriminator without logging the user out. The status mapping moved into
utils/gitSourceHttp so it can be unit-tested without booting the app.

mapGitError also relied on the HttpError class alone, so any non-2xx response
(including 404) was classified as auth failure. It now inspects the numeric
status on err.data and considers whether a token was supplied, producing more
actionable messages for missing repos, private repos, and wrong-scope tokens.

e2e/git-sources.spec.ts

@@ -310,5 +310,72 @@ test.describe('Create stack from Git', () => {
     }, CREATE_FROM_GIT_STACK);
     expect(contentStatus.status).toBe(200);
     expect(contentStatus.body).toMatch(/services:/);
+    // Backend contract: commitSha is returned at full length so the frontend
+    // can build the short-SHA suffix for the success toast. Guard it here so
+    // the toast copy can never drift without a test catching it.
+    expect(result.body?.commitSha).toMatch(/^[0-9a-f]{40}$/);
+  });
+
+  test('UI flow: success toast includes the short commit SHA', async ({ page }) => {
+    // Pre-flight check: if the upstream is unreachable from this runner, the
+    // UI flow will also fail. Probe the API with a throwaway name first so we
+    // skip cleanly instead of hanging on a dialog that never resolves.
+    const probeName = `${CREATE_FROM_GIT_STACK}-probe`;
+    const probe = await page.evaluate(async (name) => {
+      const res = await fetch(`/api/stacks/from-git`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        credentials: 'include',
+        body: JSON.stringify({
+          stack_name: name,
+          repo_url: 'https://github.com/docker/awesome-compose.git',
+          branch: 'master',
+          compose_path: 'nginx-golang/compose.yaml',
+          auth_type: 'none',
+          deploy_now: false,
+        }),
+      });
+      return { status: res.status };
+    }, probeName);
+
+    // Always tear down the probe, whether it succeeded or not.
+    await page.evaluate(async (name) => {
+      await fetch(`/api/stacks/${name}/git-source`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
+      await fetch(`/api/stacks/${name}`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
+    }, probeName);
+
+    if (probe.status >= 400) {
+      test.skip(true, `Upstream unreachable (status ${probe.status}); skipping UI toast test`);
+      return;
+    }
+
+    const uiName = `${CREATE_FROM_GIT_STACK}-ui`;
+    // Ensure no leftover row from a prior failing run.
+    await page.evaluate(async (name) => {
+      await fetch(`/api/stacks/${name}/git-source`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
+      await fetch(`/api/stacks/${name}`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
+    }, uiName);
+
+    try {
+      await openCreateStackDialog(page);
+      await page.getByRole('dialog').getByRole('tab', { name: /From Git/i }).click();
+
+      await page.locator('#create-git-stack-name').fill(uiName);
+      await page.locator('#git-source-repo').fill('https://github.com/docker/awesome-compose.git');
+      await page.locator('#git-source-branch').fill('master');
+      await page.locator('#git-source-path').fill('nginx-golang/compose.yaml');
+
+      await page.getByRole('dialog').getByRole('button', { name: /Create from Git/i }).click();
+
+      // The toast copy is "Stack created from Git @ <short sha>." — match the
+      // @-delimited 7-char hex suffix so any drift in wording still passes as
+      // long as the SHA is surfaced.
+      await expect(page.getByText(/@ [0-9a-f]{7}/).first()).toBeVisible({ timeout: 20_000 });
+    } finally {
+      await page.evaluate(async (name) => {
+        await fetch(`/api/stacks/${name}/git-source`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
+        await fetch(`/api/stacks/${name}`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
+      }, uiName);
+    }
   });
 });