feat: remove built-in tool types distinction

- Drop is_builtin column from tool_types table
- Remove built-in tool seeding from startup
- Remove is_builtin from API schemas and frontend types
- Update tool-types spec to reflect removal of built-in concept
- Add Alembic migration for column removal
- Update tests to work without built-in distinction

openspec/changes/archive/2026-05-23-remove-built-in-tools/specs/tool-types/spec.md

@@ -0,0 +1,44 @@
+## MODIFIED Requirements
+
+### Requirement: Tool Type Model
+
+The system SHALL store tool type definitions in the database without built-in vs custom distinction.
+
+#### Scenario: Create tool type
+- GIVEN an admin user
+- WHEN they define a new tool type
+- THEN the following fields are stored:
+  - name: Tool identifier
+  - description: Human-readable description
+  - docker_compose_template: Compose file template
+  - icon: Visual identifier
+  - category: Tool category
+  - default_env_vars: Default environment variables
+  - default_port: **Required** primary port the tool listens on
+  - interfaces: List of supported interfaces ("web", "terminal")
+
+#### Scenario: Tool type without port rejected
+- GIVEN a user creating a tool type without `default_port`
+- WHEN the request is submitted
+- THEN the system rejects with a 422 validation error
+
+## REMOVED Requirements
+
+### Requirement: Built-in Tools
+
+**Reason**: Built-in tools are now regular preconfigured tool types in the database, not special privileged types.
+**Migration**: Built-in tool types (code-server, jupyter-notebook, opencode) are seeded as regular database records during migration. They can be edited or deleted like any other tool type.
+
+### Requirement: Template Validation
+
+The system SHALL validate Docker Compose templates.
+
+#### Scenario: Invalid template
+- GIVEN an invalid Docker Compose template
+- WHEN a user tries to create/update a tool type
+- THEN the system rejects with validation errors
+
+#### Scenario: Port not exposed in template
+- GIVEN a tool type with `default_port: 8443`
+- WHEN the compose template does not expose port 8443
+- THEN the system rejects with a validation error indicating the port mismatch