Add Node bootstrap validation and Porkbun DNS controls

[moritzbrantner]

Summary

• Adds Node.js 22 bootstrap, Python packaging tooling, and tighter deployment validation for supported single-server apps.
• Expands server.conf and docs to clearly define the supported scope: static sites, single-process Node/Bun services, and single-process Python services behind nginx and systemd.
• Adds Porkbun DNS management to the status webapp and CLI workflow, including list/create/edit/delete support behind admin authentication.
• Updates example repos and contract tests to reflect the new deployment and DNS validation rules.

Testing

• Added and updated unit/integration coverage for deployment validation, registry contract checks, server.conf contract checks, and script entrypoints.
• Added webapp tests for the new Porkbun DNS dashboard controls and control-layer CLI integration.
• Not run: full repo test suite in this environment.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 48895a1239

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[moritzbrantner]

Closing as superseded by merged PR #26.

Disposition of this PR's work:

Retain only as a possible later legacy-safety change

• the narrowly scoped registry collision concept: reject duplicate domains, systemd service names, and runtime ports while the compatibility engine is still in use
• if pursued, reimplement it from current main in a small independent PR with focused tests; do not cherry-pick this branch wholesale

Discard

• imperative Porkbun list/create/edit/delete code in the custom CLI and status dashboard; DNSControl now owns declarative DNS and preview-before-push
• provider credentials and provider-specific behavior in the legacy webapp
• Node.js/Python/runtime bootstrap expansion for the host-native deployment platform; Dokploy now owns build/runtime capabilities
• documentation and examples that present nginx/systemd/server.conf as the growing canonical platform
• the restrictive primary-domain-plus-www TLS alias policy, which is not required for migration compatibility and could narrow existing configurations

The unresolved DNS edit finding is therefore not carried forward: the entire imperative edit path is being removed from the intended architecture, not repaired.