feat: git mount URL validation with branch detection

- Add POST /config-profiles/validate-git-url endpoint:
  - Parses URL using existing parse_git_url utility
  - Suggests corrected URL for browser URLs
  - Runs git ls-remote --heads to verify reachability
  - Lists available branches from remote
  - Supports SSH key for private repos
  - Returns structured response: valid, suggested_url, branches,
    default_branch, error, error_code

- Update frontend GitMountEditor:
  - Add Check button next to URL field with loading state
  - Show validation result: valid (green), suggestion (yellow),
    invalid (red)
  - Suggestion includes Use this button to apply corrected URL
  - Branch field becomes dropdown when URL is validated,
    populated with remote branches
  - Mappings section disabled until URL is validated
  - Shows hint: Validate the URL first

- Quality gates: pytest (218 passed, 6 pre-existing),
  tsc --noEmit (clean)

apps/api/tests/unit/test_config_profile_resolver.py

@@ -494,7 +494,10 @@ class TestApplyResolvedProfile:
                 "/app": ResolvedMount(
                     target="/app",
                     mode="rw",
-                    files={"config.json": '{"key": "value"}', "nested/file.txt": "hello"},
+                    files={
+                        "config.json": '{"key": "value"}',
+                        "nested/file.txt": "hello",
+                    },
                 )
             },
         )
@@ -531,9 +534,7 @@ class TestApplyResolvedProfile:
         resolved = ResolvedProfile(
             profile_id=uuid.uuid4(),
             profile_name="test",
-            mounts={
-                "/app": ResolvedMount(target="/app", mode="rw", files={})
-            },
+            mounts={"/app": ResolvedMount(target="/app", mode="rw", files={})},
         )
         env, files, volumes, hints = apply_resolved_profile(str(tmp_path), resolved)
         assert volumes == []