docs(openspec): add OpenSpec changes for FN-005, FN-006, FN-008, FN-009, FN-010

- Add frontend-foundation change (FN-005) with 46 tasks
- Add deployment-config change (FN-006) with 27 tasks
- Add runfusion-poc/opencode-poc change (FN-008) with 25 tasks
- Add config-secrets change (FN-009) with 31 tasks
- Add codeserver-spawn change (FN-010) with 38 tasks
- Include project specsheet and configuration
- Archive completed deployment-config change

openspec/changes/deployment-config/specs/traefik-label-generator/spec.md

@@ -0,0 +1,24 @@
+## ADDED Requirements
+
+### Requirement: Tool spawn generates Traefik labels
+The system SHALL generate Docker labels for Traefik when spawning a tool instance.
+
+#### Scenario: Label generation on spawn
+- **WHEN** a tool instance is spawned
+- **THEN** the backend generates Traefik router and service labels
+- **AND** labels include rule, service, port, and TLS configuration
+- **AND** labels are stored with the tool instance metadata
+
+#### Scenario: Label format
+- **WHEN** labels are generated for a tool instance
+- **THEN** router rule uses Host(`{subdomain}.{domain}`)
+- **AND** service points to the container's exposed port
+- **AND** TLS is enabled with certResolver
+
+### Requirement: Label generation handles multiple instances
+The system SHALL generate unique labels for each tool instance.
+
+#### Scenario: Unique router names
+- **WHEN** multiple instances of the same tool exist
+- **THEN** each instance gets a unique router name
+- **AND** no label collisions occur