feat(opencode-web-terminal): complete OpenCode web terminal implementation

- Update OpenCode compose template with web server on port 3000
- Add default_port=3000 and interfaces=[terminal, web] to OpenCode seed data
- Remove hardcoded 8080 fallback in tunnel creation
- Fail gracefully when tool type has no default_port configured
- Update frontend ToolType API to include default_port, category, interfaces
- Add port, category, and interfaces fields to tool type creation form
- Display port and interfaces in tool type cards
- Create migration 0012 to make default_port non-nullable
- Set default_port values for existing built-in tool types
- Quality gates: typecheck ✓, build ✓, Python syntax ✓

openspec/changes/opencode-web-terminal/specs/opencode-web-server/spec.md

@@ -0,0 +1,39 @@
+## ADDED Requirements
+
+### Requirement: OpenCode runs a web server
+
+The system SHALL configure OpenCode containers to run a web server accessible on port 3000.
+
+#### Scenario: OpenCode container starts
+- **GIVEN** an OpenCode tool instance
+- **WHEN** the container starts
+- **THEN** a web server is running on port 3000 inside the container
+- **AND** the server serves a web terminal interface
+
+### Requirement: OpenCode exposes web interface
+
+The system SHALL mark OpenCode as having both terminal and web interfaces.
+
+#### Scenario: OpenCode instance created
+- **GIVEN** a new OpenCode instance
+- **WHEN** the instance list is displayed
+- **THEN** both "Open" and "Terminal" buttons are shown
+
+### Requirement: OpenCode web terminal uses correct port
+
+The system SHALL use port 3000 when creating tunnels for OpenCode instances.
+
+#### Scenario: Tunnel created for OpenCode
+- **GIVEN** an OpenCode instance with `default_port: 3000`
+- **WHEN** the instance starts and creates a tunnel
+- **THEN** the tunnel targets `http://container-name:3000`
+
+### Requirement: OpenCode web terminal displays properly
+
+The system SHALL serve a functional web terminal interface for OpenCode.
+
+#### Scenario: User opens OpenCode web UI
+- **GIVEN** a running OpenCode instance
+- **WHEN** the user clicks the "Open" button
+- **THEN** a new tab opens with the OpenCode web interface
+- **AND** the interface shows a terminal connected to the OpenCode process

openspec/changes/opencode-web-terminal/specs/tool-port-configuration/spec.md

@@ -0,0 +1,38 @@
+## ADDED Requirements
+
+### Requirement: Tool types must define a default port
+
+The system SHALL require all tool types to specify a `default_port`.
+
+#### Scenario: Creating tool type without port
+- **GIVEN** a user creating a new tool type
+- **WHEN** they omit the `default_port` field
+- **THEN** the system rejects the request with a 422 error
+
+#### Scenario: Creating tool type with port
+- **GIVEN** a user creating a new tool type with `default_port: 3000`
+- **WHEN** the request is submitted
+- **THEN** the tool type is created successfully
+
+### Requirement: Tool type port must be exposed in compose template
+
+The system SHALL validate that the compose template exposes the port defined in `default_port`.
+
+#### Scenario: Port mismatch
+- **GIVEN** a tool type with `default_port: 8443`
+- **WHEN** the compose template only exposes port `3000`
+- **THEN** the system rejects with an error indicating the port mismatch
+
+#### Scenario: Port exposed correctly
+- **GIVEN** a tool type with `default_port: 8443`
+- **WHEN** the compose template exposes port `8443` via `ports: ["8443:8443"]`
+- **THEN** the tool type is accepted
+
+### Requirement: Tool types support multiple interfaces
+
+The system SHALL allow tool types to specify multiple interfaces.
+
+#### Scenario: Tool with web and terminal interfaces
+- **GIVEN** a tool type with `interfaces: ["terminal", "web"]`
+- **WHEN** an instance is created
+- **THEN** the instance shows both "Open" (web) and "Terminal" buttons in the UI

openspec/changes/opencode-web-terminal/specs/tool-types/spec.md

@@ -0,0 +1,48 @@
+## MODIFIED Requirements
+
+### Requirement: Tool Type Model
+
+The system SHALL store tool type definitions in the database.
+
+#### Scenario: Create tool type
+- GIVEN an admin user
+- WHEN they define a new tool type
+- THEN the following fields are stored:
+  - name: Tool identifier
+  - description: Human-readable description
+  - docker_compose_template: Compose file template
+  - icon: Visual identifier
+  - category: Tool category
+  - default_env_vars: Default environment variables
+  - default_port: **Required** primary port the tool listens on
+  - interfaces: List of supported interfaces ("web", "terminal")
+
+#### Scenario: Tool type without port rejected
+- GIVEN a user creating a tool type without `default_port`
+- WHEN the request is submitted
+- THEN the system rejects with a 422 validation error
+
+### Requirement: Built-in Tools
+
+The system SHALL include default tool types.
+
+#### Scenario: Built-in tools
+- GIVEN a fresh installation
+- THEN these tool types are pre-configured:
+  - code-server: VS Code in browser (port 8443, interfaces: ["web"])
+  - jupyter-notebook: Jupyter notebooks (port 8888, interfaces: ["web"])
+  - opencode: OpenCode agent environment (port 3000, interfaces: ["terminal", "web"])
+
+### Requirement: Template Validation
+
+The system SHALL validate Docker Compose templates.
+
+#### Scenario: Invalid template
+- GIVEN an invalid Docker Compose template
+- WHEN a user tries to create/update a tool type
+- THEN the system rejects with validation errors
+
+#### Scenario: Port not exposed in template
+- GIVEN a tool type with `default_port: 8443`
+- WHEN the compose template does not expose port 8443
+- THEN the system rejects with a validation error indicating the port mismatch