feat: implement repository clone mode with SSH key support

- Add clone_mode and branch fields to tool_instances
- Add ssh_key_id to git_repositories for per-repo SSH key assignment
- Implement host-side git cloning with branch selection (default: main)
- Mount SSH keys into containers for git operations in clone mode
- Add dirty state check on clone-mode instance deletion with confirmation
- Update SessionsPage with mount/clone selector, branch input, SSH key display
- Add SSH key selector to repository creation form
- Add dirty delete confirmation modal with changed files list
- Update API schemas and endpoints for new fields
- Sync delta specs to main specs (git-repo, tool-instances, repo-clone-mode)
- Archive completed OpenSpec change: repo-clone-mode-with-ssh
- Document git requirement for custom tool types

Quality gates: Frontend typecheck and build passed
OpenSpec: repo-clone-mode-with-ssh archived with all tasks complete

openspec/specs/tool-types/spec.md

@@ -1,10 +1,4 @@
-# Tool Type Definition Specification
-
-## Purpose
-
-Define and register tool types using Docker Compose templates for launching development tools.
-
-## Requirements
+## MODIFIED Requirements
 
 ### Requirement: Tool Type Model
 
@@ -20,21 +14,13 @@ The system SHALL store tool type definitions in the database.
   - icon: Visual identifier
   - category: Tool category
   - default_env_vars: Default environment variables
-  - default_ports: Exposed ports
+  - default_port: **Required** primary port the tool listens on
+  - interfaces: List of supported interfaces ("web", "terminal")
 
-### Requirement: Template Variables
-
-The system SHALL support template variable substitution.
-
-#### Scenario: Variable substitution
-- GIVEN a Docker Compose template
-- WHEN it's rendered for a tool instance
-- THEN these variables are substituted:
-  - `{{REPO_PATH}}`: Path to the git repository
-  - `{{WORKSPACE_DIR}}`: Working directory inside container
-  - `{{USER_ID}}`: User identifier
-  - `{{PROJECT_ID}}`: Project identifier
-  - `{{TOOL_ID}}`: Tool instance identifier
+#### Scenario: Tool type without port rejected
+- GIVEN a user creating a tool type without `default_port`
+- WHEN the request is submitted
+- THEN the system rejects with a 422 validation error
 
 ### Requirement: Built-in Tools
 
@@ -43,9 +29,9 @@ The system SHALL include default tool types.
 #### Scenario: Built-in tools
 - GIVEN a fresh installation
 - THEN these tool types are pre-configured:
-  - code-server: VS Code in browser
-  - jupyter-notebook: Jupyter notebooks
-  - opencode: OpenCode agent environment
+  - code-server: VS Code in browser (port 8443, interfaces: ["web"])
+  - jupyter-notebook: Jupyter notebooks (port 8888, interfaces: ["web"])
+  - opencode: OpenCode agent environment (port 3000, interfaces: ["terminal", "web"])
 
 ### Requirement: Template Validation
 
@@ -56,12 +42,7 @@ The system SHALL validate Docker Compose templates.
 - WHEN a user tries to create/update a tool type
 - THEN the system rejects with validation errors
 
-## Dependencies
-
-- Database models: ToolType
-
-## Quality Gates
-
-- `pytest` must pass
-- `mypy .` must pass
-- `ruff check .` must pass
+#### Scenario: Port not exposed in template
+- GIVEN a tool type with `default_port: 8443`
+- WHEN the compose template does not expose port 8443
+- THEN the system rejects with a validation error indicating the port mismatch