feat: SQLite-backed installations, REST API, admin auth and web UI

Replaces the slice-2 hardcoded installation with a full install/deploy
pipeline:

- SQLite persistence (better-sqlite3) with a single `installations`
  table and a draft -> cloning -> building -> built -> starting ->
  running/error/stopped state machine; env vars and bearer tokens are
  encrypted at rest (AES-256-GCM, key derived from MASTER_KEY).
- Build/run orchestration: git clone (+ .env.example key detection),
  `nixpacks build` as a logged subprocess, dockerode container
  run/stop with forced host/port env vars and a TCP-connect health
  check before flipping an installation to "running".
- REST API (installations CRUD, build/deploy/redeploy, logs, token
  regeneration) behind single-operator session-cookie auth with a
  basic login lockout.
- Vite+React admin SPA: login, installation list, install wizard, and
  a detail page to configure env vars, trigger build/deploy/redeploy,
  view the build log, and copy the authenticated /mcp/<slug> URL.
- Dockerfile (multi-stage, pulls in nixpacks + the Docker CLI) and
  docker-compose.yml for production deployment.

Validated end-to-end against a real cloned repo: draft creation with
env-key detection, build, the error path on a failed health check, and
delete, all through the live API.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/src/App.tsx

@@ -0,0 +1,28 @@
+import { useEffect, useState } from "react";
+import { BrowserRouter, Routes, Route } from "react-router-dom";
+import { api } from "./api/client";
+import { Login } from "./pages/Login";
+import { InstallationList } from "./pages/InstallationList";
+import { InstallationDetail } from "./pages/InstallationDetail";
+
+export function App() {
+  const [authenticated, setAuthenticated] = useState<boolean | null>(null);
+
+  useEffect(() => {
+    api.session().then((s) => setAuthenticated(s.authenticated));
+  }, []);
+
+  if (authenticated === null) return null;
+  if (!authenticated) return <Login onLoggedIn={() => setAuthenticated(true)} />;
+
+  return (
+    <BrowserRouter>
+      <div style={{ maxWidth: 900, margin: "0 auto", padding: 16, fontFamily: "sans-serif" }}>
+        <Routes>
+          <Route path="/" element={<InstallationList />} />
+          <Route path="/installations/:id" element={<InstallationDetail />} />
+        </Routes>
+      </div>
+    </BrowserRouter>
+  );
+}