Make dev workspaces serve a working browser IDE end to end

The workspace feature shipped its routes, agent tools and docs, but the
editor was never reachable: the project page had no entry point, the ppy
image had no code-server binary, no certificate was ever requested for a
tunnel, and both nginx and the proxy dropped what the editor needs.

- Add a VS Code button to the project action row and a Workspace item to
  the overflow menu, gated by can_open_workspace plus a running instance
  (viewer_can_workspace and workspace_editor_url on ProjectDetailOut).
- Install a pinned code-server in ppy.Dockerfile before USER pravda and
  assert it in the build smoke test, so an image that cannot run the
  editor no longer builds green.
- Run the editor with --auth password and a per workspace 8 character
  pronounceable secret, minted once at the ensure_editor_password choke
  point and injected as PASSWORD. Keep it off WorkspaceViewOut, which the
  admin listing shares.
- Publish the editor tunnel when a workspace is created and issue its
  certificate from a new WorkspaceService phase against the molohttp admin
  API, then notify the owner with the live URL and the password. Only
  pending rows are retried, so a broken host cannot burn the ACME failure
  rate limit. Renewal stays molohttp's job.
- Forward the original Host on proxied requests and the client cookie on
  proxied websockets, so code-server scopes its session cookie to the
  public hostname and authenticates the workbench socket.
- Recreate a container stuck in the created state instead of retrying
  docker start forever against an image it can no longer run.
- Return a JSON string from WorkspaceController.dispatch; raw dicts landed
  in a tool message and aborted the turn at the model endpoint.
- Let the nginx catch-all carry websocket upgrades, keeping upstream
  keepalive, so tunnelled apps and the editor both connect.

nginx/nginx.conf.template

@@ -2,9 +2,11 @@ upstream app {
     server app:10500;
 }
 
+# A non-upgrade request maps to an EMPTY Connection header, not "close", so the
+# catch-all can use this map and still keep the upstream connection alive.
 map $http_upgrade $connection_upgrade {
     default upgrade;
-    ''      close;
+    ''      '';
 }
 
 map $uri $upload_disposition {
@@ -126,6 +128,23 @@ server {
         proxy_send_timeout 3600s;
     }
 
+    # Workspace editor: code-server HTTP assets AND its websocket share one prefix
+    # (/projects/<slug>/containers/instances/<uid>/code/...), so this location must
+    # carry both. The catch-all sets Connection "" and would break the editor.
+    location ~ ^/projects/[^/]+/containers/instances/[^/]+/code(/.*)?$ {
+        proxy_pass http://app;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+
     # Real-time direct messages websocket (/messages/ws).
     location = /messages/ws {
         proxy_pass http://app;
@@ -200,11 +219,16 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_http_version 1.1;
-        proxy_set_header Connection "";
+        # Tunnel hosts (*.tunnel.<domain>) are dispatched by the app and carry
+        # arbitrary user apps, which routinely use websockets. They arrive here,
+        # so the catch-all must forward the upgrade instead of dropping it -
+        # dropping it is what closes a tunnelled websocket with status 1006.
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
 
         proxy_connect_timeout 30s;
-        proxy_read_timeout 60s;
-        proxy_send_timeout 60s;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
 
         ${NGINX_CACHE_CONFIG}
     }