fix: move router to api layer and add missing imports/guards

- Move APIRouter definition from instance_service.py back to tool_instances.py
  (service files should not define FastAPI routers)
- Add missing prepare_manifest_instance import in tool_instances.py
- Guard repo.remote_url before clone_repository call
- Guard tool_type.compose_template before render_compose_template call
- Rename subprocess result variable to avoid shadowing SQLAlchemy Result
- Build error message as local string to avoid None/bool type issues

Quality gates: py_compile pass, LSP clean

apps/api/src/services/tool/instance_service.py

@@ -71,6 +71,7 @@ from src.auth.dependencies import _get_owned_project, _get_user
 logger = logging.getLogger(__name__)
 _event_bus = InstanceEventBus()
 
+
 async def resolve_git_mounts(
     session: AsyncSession,
     resolved: ResolvedProfile,
@@ -399,9 +400,6 @@ def expand_glob_source(source_path: str, repo_path: str) -> list[str]:
     return results
 
 
-router = APIRouter(prefix="/projects", tags=["tool-instances"])
-
-
 async def validate_config_profile(
     session: AsyncSession,
     profile_id: str | None,
@@ -741,7 +739,6 @@ def ensure_backend_network_in_compose(compose_path: str) -> None:
         logger.info("Injected backend network '%s' into compose file", network_name)
 
 
-
 async def prepare_manifest_instance(
     session: AsyncSession,
     instance: ToolInstance,
@@ -882,5 +879,3 @@ async def prepare_manifest_instance(
 
     home_dir = get_manifest_home_dir(manifest)
     return image_tag, compose_content, manifest, home_dir
-
-