feat: ordered multi-file Compose for Git sources (#1380)

* feat: ordered multi-file Compose for Git sources

Extend Git sources to deploy an ordered list of compose files merged with
docker compose -f base.yaml -f override.yaml ..., plus an optional project
directory.

- Pick and reorder compose files from the repository tree (drag to reorder on
  desktop, up/down arrows on phones); manual path entry is also supported.
- The ordered set drives every stack-scoped compose command (deploy, update,
  start/stop/restart/down, image scans, Compose Doctor) and the container
  lookup, so a service or image declared only in an override is handled too.
- Runtime keys off the materialized set, not the saved configuration: saving a
  source does not change deploy args until the pull is applied, and apply
  materializes from the pending snapshot rather than live config.
- The project directory is passed as --project-directory, with -p <stack>
  pinning the Compose project so container labels stay stable.
- The Mesh override is layered last; single-file sources are byte-identical to
  before, and existing rows keep working via the single-path fallback.

Docs cover the picker, ordering, project directory, and the new troubleshooting
and limitations (referenced files are not materialized; the dependency graph,
drift, and networking views read the primary file).

* fix: harden multi-file Git source (hash, unlink, collisions, node id)

- hashContent folds ordered file CONTENTS (not paths) so a clean multi-file
  stack is not flagged as locally edited: create/apply hash the fetched files
  (repo paths) while pull hashes the on-disk files (materialized paths), which
  previously disagreed and showed a false "local edits detected".
- Block unlinking a multi-file or project-directory Git source (409): the deploy
  spec lives on the source row, so removing it would silently revert deploys to
  root compose.yaml. Single-file sources still unlink.
- Reject materialized-path collisions in the selection validator: an additional
  file equal to or nested under compose.yaml, an ancestor/descendant overlap
  between selected files, and a project directory nested under a compose file
  (previously a 500 at materialization).
- DockerController.getContainersByStack uses the controller's node compose dir
  and passes its node id to the authored prefix, instead of the process default.

* fix: CI failures on multi-file Git source (test crash, aria query, path barrier)

- GitSourceFields no longer crashes when repoUrl/branch are falsy: the canBrowse
  trim() is optional-chained, so a reusable field component tolerates partial
  props. Fixes the apply-binding panel test, which feeds a minimal source object.
- GitSourcePanel tests query the footer Remove button by its exact name, so the
  picker's per-file "Remove <path>" buttons no longer collide with the broad
  /remove/i match (the test intent, footer Remove present/absent, is unchanged).
- validateCompose uses an inline resolve + startsWith barrier at the context-dir
  mkdir sink (CodeQL does not credit the wrapped isPathWithinBase helper),
  clearing the js/path-injection alert. The containment check is equivalent and
  contextDir is also validated upstream.

* test: update Git source E2E spec for the multi-file compose picker

The compose-file picker replaced the single #git-source-path input and added
per-file Remove buttons, so the E2E spec drove selectors that no longer exist:

- Drop the redundant compose.yaml fills (the picker defaults to compose.yaml).
- Select the footer Remove button by exact name so the picker's per-file
  "Remove <path>" buttons no longer make the locator ambiguous.
- Set a custom compose path through the picker (add via the manual input, press
  Enter, then remove the default compose.yaml).

* test: match the footer Remove button with an exact Playwright name

Playwright's getByRole name option is a substring match by default, so
{ name: 'Remove' } also matched the picker's "Remove <path>" buttons. Require an
exact match so only the footer Remove button is selected.

backend/src/services/ComposeService.ts

@@ -16,6 +16,7 @@ import { isDebugEnabled } from '../utils/debug';
 import { getErrorMessage } from '../utils/errors';
 import { describeSpawnError } from '../utils/spawnErrors';
 import { isPathWithinBase, isValidStackName } from '../utils/validation';
+import { authoredComposeFileArgs } from '../utils/authoredComposeArgs';
 import { redactSensitiveText, sanitizeForLog } from '../utils/safeLog';
 
 export class ComposeRollbackError extends Error {
@@ -86,14 +87,24 @@ export class ComposeService {
   }
 
   /**
-   * Build the `docker compose` argument prefix for a stack, splicing in the
-   * Sencho Mesh override file if the stack is opted into the mesh. When no
-   * override applies, returns args without `-f` so docker compose's built-in
-   * file discovery resolves the stack's actual compose filename. The user's
-   * source compose file is never mutated.
+   * Build the authored `docker compose` argument list for a stack: the validated
+   * multi-file deploy prefix (ordered `-f` files + `-p <stackName>` +
+   * `--project-directory`) for a Git source with an applied multi-file spec, then
+   * the Sencho Mesh override file last (highest `-f` precedence) when the stack is
+   * opted into the mesh, then the action. Single-file / non-git stacks get no file
+   * prefix, so docker compose's built-in discovery resolves the root compose.yaml,
+   * byte-identical to the pre-multi-file behavior. The user's source files are
+   * never mutated. Lifecycle commands (deploy, update, stop/start/restart/down)
+   * route through this method, so they share one file prefix plus the mesh override.
+   * Image scans (listStackImages) and the Compose Doctor (renderConfig) reuse the
+   * same `authoredComposeFileArgs` prefix directly but intentionally omit the mesh
+   * override, rendering the user's authored model without mesh injection.
    */
-  private async composeArgs(stackName: string, action: string[]): Promise<string[]> {
+  private async authoredComposeArgs(stackName: string, action: string[]): Promise<string[]> {
     const args: string[] = ['compose'];
+    const filePrefix = authoredComposeFileArgs(stackName, this.nodeId);
+    args.push(...filePrefix);
+
     let overridePath: string | null = null;
     try {
       overridePath = await MeshService.getInstance().ensureStackOverride(this.nodeId, stackName);
@@ -101,8 +112,13 @@ export class ComposeService {
       console.warn('[ComposeService] mesh override skipped:', sanitizeForLog((err as Error).message));
     }
     if (overridePath) {
-      const baseFilename = await FileSystemService.getInstance(this.nodeId).getComposeFilename(stackName);
-      args.push('-f', baseFilename, '-f', overridePath);
+      if (filePrefix.length === 0) {
+        // Single-file stack: passing any -f disables auto-discovery, so name the
+        // base file explicitly before layering the override on top of it.
+        const baseFilename = await FileSystemService.getInstance(this.nodeId).getComposeFilename(stackName);
+        args.push('-f', baseFilename);
+      }
+      args.push('-f', overridePath);
     }
     args.push(...action);
     return args;
@@ -323,7 +339,7 @@ export class ComposeService {
       const fsSvc = FileSystemService.getInstance(this.nodeId);
       await fsSvc.restoreStackFiles(stackName);
       await this.withRegistryAuth(async (env) => {
-        await this.execute('docker', await this.composeArgs(stackName, ['up', '-d', '--remove-orphans']), stackDir, ws, true, env);
+        await this.execute('docker', await this.authoredComposeArgs(stackName, ['up', '-d', '--remove-orphans']), stackDir, ws, true, env);
       }, sendOutput);
       sendOutput('=== Rolled back successfully ===\n');
       return true;
@@ -342,7 +358,7 @@ export class ComposeService {
 
   async runCommand(stackName: string, action: 'down' | 'start' | 'stop' | 'restart', ws?: WebSocket): Promise<void> {
     const stackDir = path.join(this.baseDir, stackName);
-    await this.execute('docker', ['compose', action], stackDir, ws);
+    await this.execute('docker', await this.authoredComposeArgs(stackName, [action]), stackDir, ws);
   }
 
   async deployStack(stackName: string, ws?: WebSocket, atomic?: boolean): Promise<void> {
@@ -371,7 +387,7 @@ export class ComposeService {
       }
 
       await this.withRegistryAuth(async (env) => {
-        await this.execute('docker', await this.composeArgs(stackName, ['up', '-d', '--remove-orphans']), stackDir, ws, true, env, getComposeStallTimeoutMs());
+        await this.execute('docker', await this.authoredComposeArgs(stackName, ['up', '-d', '--remove-orphans']), stackDir, ws, true, env, getComposeStallTimeoutMs());
       }, sendOutput);
 
       // Post-Deploy Health Probe
@@ -548,10 +564,10 @@ export class ComposeService {
 
       await this.withRegistryAuth(async (env) => {
         sendOutput('=== Pulling latest images ===\n');
-        await this.execute('docker', ['compose', 'pull'], stackDir, ws, true, env, getComposeStallTimeoutMs());
+        await this.execute('docker', await this.authoredComposeArgs(stackName, ['pull']), stackDir, ws, true, env, getComposeStallTimeoutMs());
 
         sendOutput('=== Recreating containers ===\n');
-        await this.execute('docker', await this.composeArgs(stackName, ['up', '-d', '--remove-orphans']), stackDir, ws, true, env, getComposeStallTimeoutMs());
+        await this.execute('docker', await this.authoredComposeArgs(stackName, ['up', '-d', '--remove-orphans']), stackDir, ws, true, env, getComposeStallTimeoutMs());
       }, sendOutput);
 
       // Post-Update Health Probe
@@ -611,7 +627,7 @@ export class ComposeService {
   public async downStack(stackName: string): Promise<void> {
     const stackPath = path.join(this.baseDir, stackName);
     try {
-      await this.execute('docker', ['compose', 'down', '--volumes', '--remove-orphans'], stackPath, undefined, false);
+      await this.execute('docker', await this.authoredComposeArgs(stackName, ['down', '--volumes', '--remove-orphans']), stackPath, undefined, false);
     } catch (error) {
       console.warn(`[Teardown] Docker down failed or nothing to clean up for ${sanitizeForLog(stackName)}`);
     }
@@ -634,7 +650,10 @@ export class ComposeService {
     if (!isPathWithinBase(stackDir, this.baseDir) || path.resolve(this.baseDir) === stackDir) {
       throw new Error('Invalid stack path');
     }
-    const stdout = await this.captureCompose(['config', '--images'], stackDir);
+    // Use the authored multi-file model (no mesh override) so override-only image
+    // refs are scanned by the policy gate; single-file stacks get an empty prefix.
+    const filePrefix = authoredComposeFileArgs(stackName, this.nodeId);
+    const stdout = await this.captureCompose([...filePrefix, 'config', '--images'], stackDir);
     const seen = new Set<string>();
     const images: string[] = [];
     for (const raw of stdout.split(/\r?\n/)) {
@@ -705,7 +724,15 @@ export class ComposeService {
     if (!stackDir.startsWith(baseResolved + path.sep)) {
       return Promise.reject(new Error('Invalid stack path'));
     }
-    const child = spawn('docker', ['compose', 'config', '--format', 'json'], {
+    // Render the authored multi-file model (no mesh override) so the Compose Doctor
+    // sees every override file; single-file stacks get an empty prefix.
+    let filePrefix: string[];
+    try {
+      filePrefix = authoredComposeFileArgs(stackName, this.nodeId);
+    } catch (err) {
+      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+    }
+    const child = spawn('docker', ['compose', ...filePrefix, 'config', '--format', 'json'], {
       cwd: stackDir,
       env: {
         ...process.env,