docs(openspec): add OpenSpec changes for FN-005, FN-006, FN-008, FN-009, FN-010

- Add frontend-foundation change (FN-005) with 46 tasks
- Add deployment-config change (FN-006) with 27 tasks
- Add runfusion-poc/opencode-poc change (FN-008) with 25 tasks
- Add config-secrets change (FN-009) with 31 tasks
- Add codeserver-spawn change (FN-010) with 38 tasks
- Include project specsheet and configuration
- Archive completed deployment-config change

openspec/changes/runfusion-poc/design.md

@@ -0,0 +1,65 @@
+## Context
+
+OpenCode is an AI-powered terminal-based development environment with a web interface. Unlike code-server which is a full web IDE, OpenCode provides a terminal experience accessible through the browser. This POC validates that the spawn system handles different runtime types including web terminal forwarding.
+
+Current state:
+- OpenCode manifest exists in apps/api/app/tools/manifests/opencode.yml
+- No container image or runtime defined yet
+- No health reporting mechanism
+- Spawn infrastructure will be built in FN-010
+
+## Goals / Non-Goals
+
+**Goals:**
+- Define OpenCode as a spawnable tool
+- Provide web terminal interface in container
+- Report health status (running/idle/error)
+- Support interactive terminal sessions
+
+**Non-Goals:**
+- Full task queue or job scheduler
+- Persistent process management
+- Log streaming (deferred)
+- Multi-language support beyond terminal
+
+## Decisions
+
+**1. Use official OpenCode Docker image**
+- Rationale: Maintained, includes AI features and web terminal
+- Alternative: Custom image - unnecessary for POC
+
+**2. OpenCode runs as a persistent container**
+- Rationale: Easier to manage lifecycle (start/stop/status). Terminal sessions need persistent container.
+- Implementation: Container runs OpenCode with web interface on port 3000
+
+**3. Health check via HTTP endpoint**
+- Rationale: Standard Docker health check mechanism. Traefik can use it.
+- Endpoint: `GET /` returns 200 when ready
+
+**4. Workspace mounted from host (same as code-server)**
+- Rationale: Consistency. Shared workspace between tools.
+- Path: `/data/workspaces/{user_slug}/{project_slug}`
+
+**5. Configs/secrets injected same as code-server**
+- Rationale: Reuse FN-009 infrastructure. No special handling needed.
+
+## Risks / Trade-offs
+
+**[Risk] OpenCode container requires significant resources**
+→ Mitigation: Set resource limits (4GB RAM, 2 CPU). Document requirements.
+
+**[Risk] Web terminal performance over slow connections**
+→ Mitigation: Use modern terminal emulation with compression. Document bandwidth requirements.
+
+**[Risk] AI features require API keys**
+→ Mitigation: Support secret injection for API keys. Document configuration.
+
+## Migration Plan
+
+No migration. New feature.
+
+## Open Questions
+
+1. Should OpenCode support multiple terminal sessions?
+2. Do we pre-configure common development tools?
+3. Should OpenCode integrate with the platform's AI provider?