feat: ordered multi-file Compose for Git sources (#1380)

* feat: ordered multi-file Compose for Git sources

Extend Git sources to deploy an ordered list of compose files merged with
docker compose -f base.yaml -f override.yaml ..., plus an optional project
directory.

- Pick and reorder compose files from the repository tree (drag to reorder on
  desktop, up/down arrows on phones); manual path entry is also supported.
- The ordered set drives every stack-scoped compose command (deploy, update,
  start/stop/restart/down, image scans, Compose Doctor) and the container
  lookup, so a service or image declared only in an override is handled too.
- Runtime keys off the materialized set, not the saved configuration: saving a
  source does not change deploy args until the pull is applied, and apply
  materializes from the pending snapshot rather than live config.
- The project directory is passed as --project-directory, with -p <stack>
  pinning the Compose project so container labels stay stable.
- The Mesh override is layered last; single-file sources are byte-identical to
  before, and existing rows keep working via the single-path fallback.

Docs cover the picker, ordering, project directory, and the new troubleshooting
and limitations (referenced files are not materialized; the dependency graph,
drift, and networking views read the primary file).

* fix: harden multi-file Git source (hash, unlink, collisions, node id)

- hashContent folds ordered file CONTENTS (not paths) so a clean multi-file
  stack is not flagged as locally edited: create/apply hash the fetched files
  (repo paths) while pull hashes the on-disk files (materialized paths), which
  previously disagreed and showed a false "local edits detected".
- Block unlinking a multi-file or project-directory Git source (409): the deploy
  spec lives on the source row, so removing it would silently revert deploys to
  root compose.yaml. Single-file sources still unlink.
- Reject materialized-path collisions in the selection validator: an additional
  file equal to or nested under compose.yaml, an ancestor/descendant overlap
  between selected files, and a project directory nested under a compose file
  (previously a 500 at materialization).
- DockerController.getContainersByStack uses the controller's node compose dir
  and passes its node id to the authored prefix, instead of the process default.

* fix: CI failures on multi-file Git source (test crash, aria query, path barrier)

- GitSourceFields no longer crashes when repoUrl/branch are falsy: the canBrowse
  trim() is optional-chained, so a reusable field component tolerates partial
  props. Fixes the apply-binding panel test, which feeds a minimal source object.
- GitSourcePanel tests query the footer Remove button by its exact name, so the
  picker's per-file "Remove <path>" buttons no longer collide with the broad
  /remove/i match (the test intent, footer Remove present/absent, is unchanged).
- validateCompose uses an inline resolve + startsWith barrier at the context-dir
  mkdir sink (CodeQL does not credit the wrapped isPathWithinBase helper),
  clearing the js/path-injection alert. The containment check is equivalent and
  contextDir is also validated upstream.

* test: update Git source E2E spec for the multi-file compose picker

The compose-file picker replaced the single #git-source-path input and added
per-file Remove buttons, so the E2E spec drove selectors that no longer exist:

- Drop the redundant compose.yaml fills (the picker defaults to compose.yaml).
- Select the footer Remove button by exact name so the picker's per-file
  "Remove <path>" buttons no longer make the locator ambiguous.
- Set a custom compose path through the picker (add via the manual input, press
  Enter, then remove the default compose.yaml).

* test: match the footer Remove button with an exact Playwright name

Playwright's getByRole name option is a substring match by default, so
{ name: 'Remove' } also matched the picker's "Remove <path>" buttons. Require an
exact match so only the footer Remove button is selected.

backend/src/__tests__/webhooks-git-source.test.ts

@@ -13,6 +13,30 @@ function adminToken(): string {
     return jwt.sign({ username: TEST_USERNAME, role: 'admin' }, TEST_JWT_SECRET, { expiresIn: '1m' });
 }
 
+function seedGitSource(stackName: string): void {
+    DatabaseService.getInstance().upsertGitSource({
+        stack_name: stackName,
+        repo_url: 'https://github.com/example/repo.git',
+        branch: 'main',
+        compose_path: 'compose.yaml',
+        compose_paths: ['compose.yaml'],
+        context_dir: null,
+        sync_env: false,
+        env_path: null,
+        auth_type: 'none',
+        encrypted_token: null,
+        auto_apply_on_webhook: false,
+        auto_deploy_on_apply: false,
+        last_applied_commit_sha: null,
+        last_applied_content_hash: null,
+        pending_commit_sha: null,
+        pending_compose_content: null,
+        pending_env_content: null,
+        pending_fetched_at: null,
+        last_debounce_at: null,
+    });
+}
+
 beforeAll(async () => {
     tmpDir = await setupTestDb();
     ({ app } = await import('../index'));
@@ -35,25 +59,7 @@ describe('node-aware Git source webhooks', () => {
     it('persists node_id when creating a webhook', async () => {
         const db = DatabaseService.getInstance();
         const nodeId = db.getDefaultNode()!.id;
-        db.upsertGitSource({
-            stack_name: 'webhook-local-git',
-            repo_url: 'https://github.com/example/repo.git',
-            branch: 'main',
-            compose_path: 'compose.yaml',
-            sync_env: false,
-            env_path: null,
-            auth_type: 'none',
-            encrypted_token: null,
-            auto_apply_on_webhook: false,
-            auto_deploy_on_apply: false,
-            last_applied_commit_sha: null,
-            last_applied_content_hash: null,
-            pending_commit_sha: null,
-            pending_compose_content: null,
-            pending_env_content: null,
-            pending_fetched_at: null,
-            last_debounce_at: null,
-        });
+        seedGitSource('webhook-local-git');
 
         const res = await request(app)
             .post('/api/webhooks')
@@ -117,25 +123,7 @@ describe('node-aware Git source webhooks', () => {
     it('rejects retargeting an existing git-pull webhook without a Git source', async () => {
         const db = DatabaseService.getInstance();
         const nodeId = db.getDefaultNode()!.id;
-        db.upsertGitSource({
-            stack_name: 'retarget-source-stack',
-            repo_url: 'https://github.com/example/repo.git',
-            branch: 'main',
-            compose_path: 'compose.yaml',
-            sync_env: false,
-            env_path: null,
-            auth_type: 'none',
-            encrypted_token: null,
-            auto_apply_on_webhook: false,
-            auto_deploy_on_apply: false,
-            last_applied_commit_sha: null,
-            last_applied_content_hash: null,
-            pending_commit_sha: null,
-            pending_compose_content: null,
-            pending_env_content: null,
-            pending_fetched_at: null,
-            last_debounce_at: null,
-        });
+        seedGitSource('retarget-source-stack');
         const webhookId = db.addWebhook({
             node_id: nodeId,
             name: 'retarget git webhook',