docs(openspec): add OpenSpec changes for FN-005, FN-006, FN-008, FN-009, FN-010

- Add frontend-foundation change (FN-005) with 46 tasks
- Add deployment-config change (FN-006) with 27 tasks
- Add runfusion-poc/opencode-poc change (FN-008) with 25 tasks
- Add config-secrets change (FN-009) with 31 tasks
- Add codeserver-spawn change (FN-010) with 38 tasks
- Include project specsheet and configuration
- Archive completed deployment-config change

openspec/changes/deployment-config/specs/subdomain-routing/spec.md

@@ -0,0 +1,23 @@
+## ADDED Requirements
+
+### Requirement: Each tool instance gets a unique subdomain
+The system SHALL assign a unique HTTPS subdomain to each running tool instance.
+
+#### Scenario: Subdomain pattern
+- **WHEN** a tool instance is spawned
+- **THEN** its subdomain follows `{tool}-{project}-{user}.{domain}`
+- **AND** the subdomain is deterministic based on instance metadata
+
+#### Scenario: Subdomain accessibility
+- **WHEN** a tool instance reaches running status
+- **THEN** its subdomain resolves via DNS
+- **AND** Traefik routes the subdomain to the container
+- **AND** the user can access the tool via the subdomain URL
+
+### Requirement: Subdomain is released on stop
+The system SHALL remove Traefik routing when a tool instance stops.
+
+#### Scenario: Stop removes routing
+- **WHEN** a tool instance is stopped
+- **THEN** Traefik labels are removed or disabled
+- **AND** the subdomain no longer routes to the container