feat: ship agent-first mission control v0.2.57

.gitea/workflows/ci.yaml

@@ -35,9 +35,27 @@ jobs:
       - name: Build
         run: dotnet build backend-tests/Nexus.Api.Tests.csproj --no-restore --configuration Release
 
+      - name: Verify OpenAPI contract
+        run: |
+          test -f backend/openapi/Nexus.Api.json
+          test -z "$(git status --porcelain --untracked-files=all -- backend/openapi/Nexus.Api.json)"
+
       - name: Test
         run: dotnet test backend-tests/Nexus.Api.Tests.csproj --no-build --configuration Release --verbosity normal
 
+      - name: Docker integration tests
+        if: ${{ vars.NEXUS_RUN_DOCKER_INTEGRATION_TESTS == 'true' }}
+        timeout-minutes: 15
+        env:
+          NEXUS_RUN_DOCKER_INTEGRATION_TESTS: "true"
+          NEXUS_RUN_TOXIPROXY_INTEGRATION_TESTS: ${{ vars.NEXUS_RUN_TOXIPROXY_INTEGRATION_TESTS }}
+        run: >-
+          dotnet test backend-tests/Nexus.Api.Tests.csproj
+          --no-build
+          --configuration Release
+          --filter "Category=DockerIntegration"
+          --verbosity normal
+
   # ─── Frontend ──────────────────────────────────
   frontend:
     name: Frontend (Vue/TS)
@@ -61,7 +79,13 @@ jobs:
         working-directory: frontend
 
       - name: Type check
-        run: pnpm exec vue-tsc --noEmit
+        run: pnpm typecheck
+        working-directory: frontend
+
+      - name: Verify generated API types
+        run: |
+          pnpm openapi:generate
+          test -z "$(git status --porcelain --untracked-files=all -- src/api/generated/schema.d.ts)"
         working-directory: frontend
 
       - name: Test
@@ -72,6 +96,14 @@ jobs:
         run: pnpm build
         working-directory: frontend
 
+      - name: Install Playwright Chromium
+        run: pnpm exec playwright install --with-deps chromium
+        working-directory: frontend
+
+      - name: Browser end-to-end tests
+        run: pnpm test:e2e
+        working-directory: frontend
+
   # ─── Security ──────────────────────────────────
   security:
     name: Security Check
@@ -115,6 +147,7 @@ jobs:
       DEPLOY_PATH: /home/projekte_bao/nexus
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
       ENV_JWT_KEY: ${{ secrets.ENV_JWT_KEY }}
+      ENV_BOOTSTRAP_OWNER_PASSWORD: ${{ secrets.ENV_BOOTSTRAP_OWNER_PASSWORD }}
       ENV_OPENCLAW_TOKEN: ${{ secrets.ENV_OPENCLAW_TOKEN }}
     steps:
       - name: Checkout

.gitea/workflows/deploy.yaml

@@ -16,6 +16,7 @@ jobs:
       DEPLOY_PATH: /home/projekte_bao/nexus
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
       ENV_JWT_KEY: ${{ secrets.ENV_JWT_KEY }}
+      ENV_BOOTSTRAP_OWNER_PASSWORD: ${{ secrets.ENV_BOOTSTRAP_OWNER_PASSWORD }}
       ENV_OPENCLAW_TOKEN: ${{ secrets.ENV_OPENCLAW_TOKEN }}
     steps:
       - name: Checkout main

.gitea/workflows/rollback.yaml

@@ -46,6 +46,7 @@ jobs:
       ENV_TMPFILE: /tmp/nexus-rollback-env
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
       ENV_JWT_KEY: ${{ secrets.ENV_JWT_KEY }}
+      ENV_BOOTSTRAP_OWNER_PASSWORD: ${{ secrets.ENV_BOOTSTRAP_OWNER_PASSWORD }}
       ENV_OPENCLAW_TOKEN: ${{ secrets.ENV_OPENCLAW_TOKEN }}
 
     steps:
@@ -112,6 +113,7 @@ jobs:
           JWT_ISSUER=nexus
           JWT_AUDIENCE=nexus-web
           BOOTSTRAP_OWNER_EMAIL=vmbao62@hotmail.de
+          BOOTSTRAP_OWNER_PASSWORD=${ENV_BOOTSTRAP_OWNER_PASSWORD:-}
           OPENCLAW_BASE_URL=http://host.docker.internal:18789
           OPENCLAW_GATEWAY_TOKEN=${ENV_OPENCLAW_TOKEN}
           OPENCLAW_GATEWAY_PASSWORD=