docs(openspec): add OpenSpec changes for FN-005, FN-006, FN-008, FN-009, FN-010

- Add frontend-foundation change (FN-005) with 46 tasks
- Add deployment-config change (FN-006) with 27 tasks
- Add runfusion-poc/opencode-poc change (FN-008) with 25 tasks
- Add config-secrets change (FN-009) with 31 tasks
- Add codeserver-spawn change (FN-010) with 38 tasks
- Include project specsheet and configuration
- Archive completed deployment-config change

openspec/changes/deployment-config/specs/portainer-deployment/spec.md

@@ -0,0 +1,22 @@
+## ADDED Requirements
+
+### Requirement: Stack deploys via Portainer
+The system SHALL provide a Portainer-compatible stack definition.
+
+#### Scenario: Portainer stack file
+- **WHEN** an operator deploys via Portainer
+- **THEN** they can paste the stack definition into Portainer's stack editor
+- **AND** Portainer can pull and deploy all services
+
+#### Scenario: Environment variables in Portainer
+- **WHEN** the stack is deployed via Portainer
+- **THEN** environment variables are configured in Portainer's UI
+- **AND** the stack references these variables
+
+### Requirement: Deployment documentation is complete
+The system SHALL provide operator documentation for deployment.
+
+#### Scenario: Deployment guide
+- **WHEN** an operator reads docs/deployment.md
+- **THEN** they find step-by-step instructions for Portainer deployment
+- **AND** prerequisites and assumptions are clearly stated

openspec/changes/deployment-config/specs/production-compose-stack/spec.md

@@ -0,0 +1,28 @@
+## ADDED Requirements
+
+### Requirement: Production stack includes all required services
+The system SHALL provide a production Docker Compose stack with API, web, Traefik, and PostgreSQL.
+
+#### Scenario: Stack services
+- **WHEN** the production stack is deployed
+- **THEN** the following services run: api, web, traefik, db
+- **AND** Traefik routes requests to the appropriate service
+- **AND** services communicate via isolated Docker networks
+
+#### Scenario: Environment configuration
+- **WHEN** the stack starts
+- **THEN** it reads environment variables from .env
+- **AND** sensitive values are not hardcoded
+
+### Requirement: Production stack is secure by default
+The system SHALL configure security headers and access controls in production.
+
+#### Scenario: HTTPS only
+- **WHEN** the stack runs in production
+- **THEN** all traffic uses HTTPS
+- **AND** HTTP redirects to HTTPS
+
+#### Scenario: Network isolation
+- **WHEN** the stack is deployed
+- **THEN** platform services and tool containers are on separate networks
+- **AND** tool containers cannot access the database directly

openspec/changes/deployment-config/specs/subdomain-routing/spec.md

@@ -0,0 +1,23 @@
+## ADDED Requirements
+
+### Requirement: Each tool instance gets a unique subdomain
+The system SHALL assign a unique HTTPS subdomain to each running tool instance.
+
+#### Scenario: Subdomain pattern
+- **WHEN** a tool instance is spawned
+- **THEN** its subdomain follows `{tool}-{project}-{user}.{domain}`
+- **AND** the subdomain is deterministic based on instance metadata
+
+#### Scenario: Subdomain accessibility
+- **WHEN** a tool instance reaches running status
+- **THEN** its subdomain resolves via DNS
+- **AND** Traefik routes the subdomain to the container
+- **AND** the user can access the tool via the subdomain URL
+
+### Requirement: Subdomain is released on stop
+The system SHALL remove Traefik routing when a tool instance stops.
+
+#### Scenario: Stop removes routing
+- **WHEN** a tool instance is stopped
+- **THEN** Traefik labels are removed or disabled
+- **AND** the subdomain no longer routes to the container

openspec/changes/deployment-config/specs/traefik-label-generator/spec.md

@@ -0,0 +1,24 @@
+## ADDED Requirements
+
+### Requirement: Tool spawn generates Traefik labels
+The system SHALL generate Docker labels for Traefik when spawning a tool instance.
+
+#### Scenario: Label generation on spawn
+- **WHEN** a tool instance is spawned
+- **THEN** the backend generates Traefik router and service labels
+- **AND** labels include rule, service, port, and TLS configuration
+- **AND** labels are stored with the tool instance metadata
+
+#### Scenario: Label format
+- **WHEN** labels are generated for a tool instance
+- **THEN** router rule uses Host(`{subdomain}.{domain}`)
+- **AND** service points to the container's exposed port
+- **AND** TLS is enabled with certResolver
+
+### Requirement: Label generation handles multiple instances
+The system SHALL generate unique labels for each tool instance.
+
+#### Scenario: Unique router names
+- **WHEN** multiple instances of the same tool exist
+- **THEN** each instance gets a unique router name
+- **AND** no label collisions occur