feat: enforce single tool type with port configuration

- Replace interfaces array with single interface_type string (web/terminal)
- Add requires_port boolean to indicate port/tunnel needs
- Create Alembic migration for database schema change
- Update backend model, API validation, and seed data
- Update frontend types and tool workshop UI with dropdown
- Add conditional port field rendering based on interface type
- Update all frontend and backend tests

OpenSpec change: enforce-single-tool-type-with-port-config
Quality gates: frontend typecheck PASS, lint PASS, tests 37/37 PASS

openspec/specs/tool-types-definition/spec.md

@@ -11,7 +11,12 @@ The system SHALL provide a `ToolType` model to store tool definitions.
   - `name`: unique string (e.g., "code-server")
   - `display_name`: human-readable string (e.g., "VS Code Server")
   - `description`: optional text
+  - `category`: string (e.g., "editor", "notebook")
+  - `interface_type`: single string — "web" or "terminal"
+  - `requires_port`: boolean indicating if port/tunnel configuration is needed
   - `compose_template`: Docker Compose YAML string
+  - `dockerfile_template`: Dockerfile string
+  - `definition_type`: string — "compose" or "dockerfile"
   - `required_variables`: list of required template variables
   - `is_builtin`: boolean flag for system-defined types
   - `created_at`/`updated_at`: timestamps
@@ -30,7 +35,9 @@ The system SHALL provide REST API endpoints for tool type management.
 - GIVEN an admin user
 - WHEN they POST /api/tool-types with valid data
 - THEN the system creates a new tool type
-- AND validates the compose template YAML
+- AND validates `interface_type` is "web" or "terminal"
+- AND validates `requires_port` is boolean
+- AND validates the compose template YAML (if definition_type is "compose")
 - AND validates all required variables are present in template
 - AND returns 201 Created with the new tool type
 
@@ -44,6 +51,7 @@ The system SHALL provide REST API endpoints for tool type management.
 - GIVEN an admin user
 - WHEN they PUT /api/tool-types/{id} with valid data
 - THEN the system updates the tool type
+- AND validates `interface_type` is "web" or "terminal" if provided
 - AND re-validates the compose template
 - AND returns 200 OK with updated tool type
 
@@ -98,3 +106,33 @@ The system SHALL validate Docker Compose templates.
 - THEN the system SHALL require:
   - `services` key present
   - At least one service defined
+
+### Requirement: Port requirement indication
+The system SHALL allow tool types to indicate whether they require port configuration.
+
+#### Scenario: Web tool requires port
+- GIVEN a tool type with `interface_type` = "web"
+- WHEN the tool type is created or updated
+- THEN `requires_port` SHALL default to true
+- AND port-related configuration is shown in the UI
+
+#### Scenario: Terminal tool does not require port
+- GIVEN a tool type with `interface_type` = "terminal"
+- WHEN the tool type is created or updated
+- THEN `requires_port` SHALL default to false
+- AND port-related configuration is hidden in the UI
+
+### Requirement: Single interface validation
+The system SHALL enforce that each tool type has exactly one interface type.
+
+#### Scenario: Invalid interface type
+- GIVEN a tool type creation request with `interface_type` = "invalid"
+- WHEN the request is processed
+- THEN the system returns 400 Bad Request
+- AND the error message indicates valid values are "web" or "terminal"
+
+#### Scenario: Missing interface type
+- GIVEN a tool type creation request without `interface_type`
+- WHEN the request is processed
+- THEN the system returns 400 Bad Request
+- AND the error message indicates interface_type is required