Make DSH agents-as-a-service browser-usable; fix probe crash-loop (#3)

* Rewrite DSH gateway for browser sessions, HTTP and WebSocket

- Replace the Flask proxy with a Starlette ASGI app (uvicorn factory),
  keeping the control plane (claims, wake/suspend, idle sweeper).
- Add HttpOnly gateway sessions and a server-side DSH launch-token
  handshake: read the token from pod logs, exchange it for a dsh-auth
  cookie, cache per (user, pod UID, Host), refresh once on 401.
- Proxy HTTP/SSE and WebSocket (/api/remote.mux) under /u/<user>/, with
  header stripping/injection, Location rewriting and wake-on-connect.
- Add a landing/signup/login page, health endpoint, pinned dependencies,
  a read-only-rootfs gateway image, 87 cluster-free tests and docs.

* Fix DSH probe crash-loop and harden gateway manifests

- Probe /favicon.svg instead of /: DSH gates / behind its launch-token
  cookie and returns 401, which made warm-pool pods crash-loop.
- Pass DSH_TRUSTED_HOSTS through the entrypoint as --trusted-host args
  for public/ingress hosts; keep localhost trusted.
- Deploy the published :gateway image, add pods/pods-log RBAC, /healthz
  probes, read-only rootfs with a /tmp emptyDir and non-root security.
- Add optional Traefik Ingress and document the prerequisites.

* Update CI, smoke tests, build tooling and docs

- Run gateway pytest/ruff and build/smoke-test the image in CI.
- Parameterize the DSH build version and pnpm version inputs.
- Exercise cookie signup, HTML proxy, WebSocket auth, suspend/wake and
  delete in run-test-kind.sh.
- Add Makefile/build.sh targets and document the architecture, handshake,
  probes, trusted hosts, troubleshooting and limitations.

---------

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/60-ingress.yaml

@@ -0,0 +1,46 @@
+# OPTIONAL browser entry point: expose the gateway through Traefik.
+#
+# Requires 50-gateway.yaml (Service dsh-gateway:8080) and a Traefik install
+# with an IngressClass named "traefik" (k3s ships one). Replace the placeholder
+# host below with a name that resolves to your ingress address, and either
+# supply a real TLS Secret or delete the `tls:` block for plain HTTP.
+#
+# Two things must match this host:
+#   1. SandboxTemplate (10-sandboxtemplate.yaml): set DSH_TRUSTED_HOSTS to
+#      this host so DSH accepts the forwarded Host/Origin on /api.
+#   2. Gateway Deployment (50-gateway.yaml): set COOKIE_SECURE to "true"
+#      once this Ingress serves HTTPS, so the session cookie is Secure.
+#
+# WebSocket support is REQUIRED: the browser talks to /u/<user>/... and DSH
+# uses WebSockets for live session traffic. Traefik upgrades WS/SSE
+# transparently for ordinary HTTP routers, but do NOT attach buffering
+# middlewares (e.g. compress, buffering) to this router — they break streaming
+# and upgrades. `path: /` Prefix covers the landing page and every per-user
+# proxy path, so no per-sandbox Ingress is needed.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dsh-gateway
+  namespace: dsh-demo
+  # Typical Traefik + cert-manager wiring (uncomment and adapt):
+  # annotations:
+  #   traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  #   cert-manager.io/cluster-issuer: letsencrypt-prod
+  annotations: {}
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - dsh.example.com # placeholder
+      secretName: dsh-example-tls # placeholder; create/PKI-provision this Secret
+  rules:
+    - host: dsh.example.com # placeholder
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: dsh-gateway
+                port:
+                  number: 8080