## Why

Tool registry (FN-003) and deployment config (FN-006) are prerequisites for spawning tools. code-server is the primary user-facing tool in MVP. Without a spawn flow, users cannot launch development environments, which is the core value proposition.

## What Changes

- **code-server manifest refinement**: Update the built-in manifest with proper Docker image, ports, volumes, and config options
- **Spawn flow API**: Backend endpoint that creates a tool instance, generates Docker Compose service, and starts the container
- **Frontend spawn UI**: Form for selecting tool, project, and optional config overrides
- **Runtime integration**: Mount workspace, configs, secrets, and SSH keys into the code-server container
- **Auth proxy**: Ensure code-server is protected behind the platform's auth (no separate code-server password)
- **Status tracking**: Poll container status and expose it via API

## Capabilities

### New Capabilities
- `tool-spawn-api`: Backend endpoint for spawning tool instances
- `codeserver-manifest`: Refined code-server manifest with runtime configuration
- `spawn-ui`: Frontend form for tool selection and spawn configuration
- `container-lifecycle`: Start, stop, and status tracking for tool containers

### Modified Capabilities
- None (extends existing tool registry)

## Impact

- **apps/api/app/tools/manifests/code-server.yml**: Updated manifest
- **apps/api/app/routers/tool_instances.py**: Spawn endpoint enhancements
- **apps/api/app/services/spawn.py**: New spawn orchestration service
- **apps/web/src/**: New spawn UI components
- **docker-compose.yml**: May need updates for Docker socket access