fix: base Git multi-file Compose deploy env and dossier on the effective config (#1391)

* fix: resolve the root .env at deploy and render time for Git context-dir stacks

A Git multi-file source with a context dir set --project-directory to that
dir, so Docker Compose looked for .env there and missed the root .env Sencho
writes. Validation already passed the root .env with --env-file, so a stack
could validate with one effective config but deploy or render another.

Add authoredComposeEnvFileArgs, which appends --env-file <stackDir>/.env when
the applied deploy spec has a context dir and a root .env exists, and wire it
into the deploy/update, image-scan, render, and container-listing compose
invocations so they all resolve env from the same file the validator used. A
non-ENOENT access error surfaces instead of silently dropping the flag.

* fix: base multi-file Git dossier and doc-drift on the effective Compose model

The Stack Dossier and its documentation-drift check parsed only the stored root
compose file. For a multi-file Git source, services, ports, networks, or volumes
that an override file adds were invisible, so the dossier showed incomplete facts
and doc-drift could falsely warn that a documented port is unpublished when an
override actually publishes it.

Add a secret-safe GET /stacks/:name/effective-anatomy that renders the merged
effective model and extracts only structural facts (services, ports, volumes,
networks, restart), never env, label, or command values. StackAnatomyPanel
fetches it for multi-file Git stacks and feeds those facts into the dossier and
doc-drift, falling back to the root-only parse for single-file or non-git stacks
and whenever the render is unavailable.

* fix: add an inline path-injection barrier to the Git env-file resolver

CodeQL js/path-injection flagged the fs.access in authoredComposeEnvFileArgs
because the env path derives from the route-supplied stack name and the only
containment check lived in the callers, not at the sink. Resolve the stack dir
against the compose base and assert containment with startsWith inline, then
derive the .env path from the validated dir, mirroring the existing inline guards
in renderConfig and validateCompose. Valid stack names are unaffected; a name
that escapes the base now yields no --env-file.

* test: stabilize the dossier doc-drift e2e against the dossier-load race

The first assertion filled the access_urls field as soon as the Dossier panel
was visible, but the panel's GET /stacks/:name/dossier resolves by overwriting
the fields from the server (empty access_urls) and only then flips the doc-drift
gate on. When the GET landed after the fill, it clobbered the typed value and the
warning never rendered, so the test failed intermittently under CI timing. Wait
for that GET to land before typing, mirroring the spec's openStack helper.

backend/src/services/ComposeService.ts

@@ -16,7 +16,7 @@ import { isDebugEnabled } from '../utils/debug';
 import { getErrorMessage } from '../utils/errors';
 import { describeSpawnError } from '../utils/spawnErrors';
 import { isPathWithinBase, isValidStackName } from '../utils/validation';
-import { authoredComposeFileArgs } from '../utils/authoredComposeArgs';
+import { authoredComposeFileArgs, authoredComposeEnvFileArgs } from '../utils/authoredComposeArgs';
 import { redactSensitiveText, sanitizeForLog } from '../utils/safeLog';
 
 export class ComposeRollbackError extends Error {
@@ -104,6 +104,9 @@ export class ComposeService {
     const args: string[] = ['compose'];
     const filePrefix = authoredComposeFileArgs(stackName, this.nodeId);
     args.push(...filePrefix);
+    // Pin env resolution to the root .env when a context dir shifts the project
+    // directory, so deploy/update resolve the same effective config the validator did.
+    args.push(...await authoredComposeEnvFileArgs(stackName, this.nodeId));
 
     let overridePath: string | null = null;
     try {
@@ -653,7 +656,8 @@ export class ComposeService {
     // Use the authored multi-file model (no mesh override) so override-only image
     // refs are scanned by the policy gate; single-file stacks get an empty prefix.
     const filePrefix = authoredComposeFileArgs(stackName, this.nodeId);
-    const stdout = await this.captureCompose([...filePrefix, 'config', '--images'], stackDir);
+    const envFileArgs = await authoredComposeEnvFileArgs(stackName, this.nodeId);
+    const stdout = await this.captureCompose([...filePrefix, ...envFileArgs, 'config', '--images'], stackDir);
     const seen = new Set<string>();
     const images: string[] = [];
     for (const raw of stdout.split(/\r?\n/)) {
@@ -708,11 +712,11 @@ export class ComposeService {
    * finding rather than an exception. Bounded by a timeout and an output cap.
    * Rejects only when the docker binary cannot be spawned.
    */
-  public renderConfig(
+  public async renderConfig(
     stackName: string,
   ): Promise<{ rendered: string | null; stderr: string; code: number | null; timedOut: boolean }> {
     if (!isValidStackName(stackName)) {
-      return Promise.reject(new Error('Invalid stack path'));
+      throw new Error('Invalid stack path');
     }
     // Canonical inline js/path-injection barrier, kept in the same scope as the
     // spawn cwd sink below. CodeQL credits neither the wrapped isPathWithinBase
@@ -722,17 +726,19 @@ export class ComposeService {
     const baseResolved = path.resolve(this.baseDir);
     const stackDir = path.resolve(baseResolved, stackName);
     if (!stackDir.startsWith(baseResolved + path.sep)) {
-      return Promise.reject(new Error('Invalid stack path'));
+      throw new Error('Invalid stack path');
     }
     // Render the authored multi-file model (no mesh override) so the Compose Doctor
-    // sees every override file; single-file stacks get an empty prefix.
+    // sees every override file; single-file stacks get an empty prefix. The env-file
+    // flag keeps render resolving the same root .env the validator and deploy use.
     let filePrefix: string[];
     try {
       filePrefix = authoredComposeFileArgs(stackName, this.nodeId);
     } catch (err) {
-      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+      throw err instanceof Error ? err : new Error(String(err));
     }
-    const child = spawn('docker', ['compose', ...filePrefix, 'config', '--format', 'json'], {
+    const envFileArgs = await authoredComposeEnvFileArgs(stackName, this.nodeId);
+    const child = spawn('docker', ['compose', ...filePrefix, ...envFileArgs, 'config', '--format', 'json'], {
       cwd: stackDir,
       env: {
         ...process.env,