feat: config profile multi-repo mounts

- Add mappings array support to git_mount entries
- Clone repository once per git_mount entry, mount multiple subdirectories
- Normalize legacy source_path+target_path to mappings on read
- Update _merge_git_mounts to dedup by (remote_url, branch) and concatenate mappings
- Add _normalize_git_mount, _clone_git_repo, _resolve_git_mount_mappings helpers
- Update GitMountItem Pydantic model with GitMountMapping and model_validator
- Update frontend GitMountEditor component with mappings UI
- Auto-convert legacy git mount entries to mappings format on load
- Add 15 backend unit tests for normalization, resolution, and glob expansion
- Update existing config profile resolver tests for new merge behavior

Quality gates: pytest 167 passed, frontend typecheck clean

Addresses: config-profile-multi-repo-mounts

openspec/proposals/config-profile-multi-repo-mounts.md

@@ -0,0 +1,50 @@
+# Proposal: Config Profile Multi-Repo Mounts
+
+## Context
+
+Config Profiles allow users to mount external Git repositories into tool instances via `git_mounts`. Currently, each `git_mount` entry supports only **one** source_path → target_path mapping. If a user wants to mount multiple directories from the same repository (e.g., a monorepo), they must add multiple entries, each cloning the repository independently.
+
+## Goal
+
+Enable a single `git_mount` entry to declare **multiple** source/target mappings from the same repository, while cloning the repository only once per entry.
+
+## Direction
+
+**Direction A: `mappings` array with backward compatibility**
+
+Add an optional `mappings` array to each `git_mount` entry. The repository is cloned once, and each mapping creates a separate bind mount from a subdirectory of the cloned repo.
+
+If `mappings` is absent, the existing `source_path` + `target_path` fields are treated as a single mapping (backward-compatible).
+
+## Acceptance Criteria
+
+1. A `git_mount` entry can specify `mappings: [{"source_path": "...", "target_path": "..."}, ...]`
+2. The repository is cloned **exactly once** per `git_mount` entry
+3. Each mapping creates a separate Docker bind mount from the cloned repo subdirectory
+4. Existing profiles with `source_path`/`target_path` continue working without migration
+5. The Config Profile editor UI supports adding/removing mappings per git mount
+6. Glob patterns are supported in `source_path` within mappings
+7. Relative `target_path` values are resolved against `working_directory` as before
+
+## Out of Scope
+
+- Cross-entry repo deduplication (two separate git_mount entries with the same `remote_url` still clone twice)
+- SSH key per-repo configuration (can be added later)
+- Sparse checkout / partial clone optimization
+- Mounting from non-Git sources
+
+## Risks
+
+| Risk | Mitigation |
+|------|------------|
+| Schema migration complexity | No migration needed — backward-compatible |
+| Frontend UI complexity | Nested form with add/remove mapping buttons |
+| Clone directory sharing race condition | Each entry gets its own clone directory (url_hash based) |
+| Large monorepo clone time | Out of scope — full clone is existing behavior |
+
+## Related Artifacts
+
+- Exploration: `openspec/explorations/config-profile-multi-repo-mounts.md`
+- Spec: `openspec/specs/config-profile-multi-repo-mounts.md`
+- Design: `openspec/designs/config-profile-multi-repo-mounts.md`
+- Tasks: `openspec/tasks/config-profile-multi-repo-mounts.md`