feat(FN-003): add tool manifest registry with FastAPI CRUD and built-in manifests

- Add ToolManifest Pydantic models with validators for ports, mounts, health checks, and traefik config

- Implement in-memory ToolRegistry with YAML loading and built-in manifest scanning

- Add FastAPI CRUD routes for listing, retrieving, and creating tool manifests

- Include built-in manifests for runfusion and code-server

- Harden web Dockerfile with unprivileged nginx and port 8080

- Add tool manifest specification documentation and architecture updates

Fusion-Task-Id: FN-003

apps/api/app/tools/router.py

@@ -0,0 +1,37 @@
+"""FastAPI routes for the tool manifest registry."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, HTTPException, status
+
+from app.tools.models import ToolManifest
+from app.tools.registry import registry
+
+router = APIRouter(prefix="/tools", tags=["tools"])
+
+
+@router.get("", response_model=list[ToolManifest])
+def list_tools() -> list[ToolManifest]:
+    return registry.list()
+
+
+@router.get("/{tool_id}", response_model=ToolManifest)
+def get_tool(tool_id: str) -> ToolManifest:
+    manifest = registry.get(tool_id)
+    if manifest is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"Tool '{tool_id}' not found",
+        )
+    return manifest
+
+
+@router.post("", response_model=ToolManifest, status_code=status.HTTP_201_CREATED)
+def create_tool(manifest: ToolManifest) -> ToolManifest:
+    if registry.get(manifest.id) is not None:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail=f"Tool '{manifest.id}' already exists",
+        )
+    registry.register(manifest)
+    return manifest