feat(FN-003): add tool manifest registry with FastAPI CRUD and built-in manifests

- Add ToolManifest Pydantic models with validators for ports, mounts, health checks, and traefik config

- Implement in-memory ToolRegistry with YAML loading and built-in manifest scanning

- Add FastAPI CRUD routes for listing, retrieving, and creating tool manifests

- Include built-in manifests for runfusion and code-server

- Harden web Dockerfile with unprivileged nginx and port 8080

- Add tool manifest specification documentation and architecture updates

Fusion-Task-Id: FN-003

docs/architecture.md

@@ -166,26 +166,19 @@ https://code-myapp-alice.tools.example.com
 
 ## 7. Tool Manifest & Orchestration
 
-Tools are defined by manifests (FN-003) that declare:
+Tools are defined by manifest files validated against the canonical Pydantic v2 schema.
+The full schema reference, validation rules, and extension guide are documented in
+[`docs/tool-manifest-spec.md`](./tool-manifest-spec.md).
 
-- Runtime image / image tag
-- Node/npm version expectations (for executable environments)
-- Bootstrap / install commands
-- Command execution needs
-- Workspace mounts
-- Config mounts
-- Environment variables
-- Secrets
-- Ports
-- Health checks
-- Resource limits
-- Traefik routing needs (subdomain pattern, middleware)
+**Summary:** Each manifest declares the runtime image, ports, workspace/config mounts,
+environment variables, secrets, health checks, resource limits, and Traefik routing rules.
+The orchestration backend reads these manifests and generates Docker Compose service
+definitions, Traefik labels, and runtime volume/secret bindings.
 
-The platform reads manifests and generates:
-- Docker Compose service definitions
-- Traefik labels for routing
-- Volume mounts for workspace and config
-- Secret injection at runtime
+Built-in manifests for RunFusion and code-server are shipped in
+`apps/api/app/tools/manifests/` and loaded automatically on API startup.
+New standard-container tools can be added by creating a YAML manifest—no backend code
+changes are required.
 
 ## 8. MVP Phases