feat(appgate): apps with their own login can skip the node login

Some apps carry a complete account system and are broken by an upstream
challenge: git clients speak basic-auth (not browser cookies), and a
BTCPay checkout link handed to a customer must open for that customer.
Both were behind the gate's login page — the "non-browser clients need an
access token" gap disclosed in five consecutive releases.

- New manifest port policy `auth: open`: the daemon still fronts the port
  exactly like `gated` (loopback pin, external binds, frame-header fixes,
  app-down retry page, Tor upstream) but serves it without the login
  challenge. Requires auth_rationale, same burden of proof as `none`.
  Gitea 3001 and BTCPay 23000 declare it.
- Runtime operator override per app (security.set-app-gate → app-configs/
  <id>.json "gateEnabled"), surfaced as Settings → app → Access control.
  Wins over the manifest in both directions and applies on the next
  request — no restart, and it works today on catalog-covered apps whose
  signed manifest still says `gated`.
- The gate resolves policy per-request from the live port map, so a
  toggle takes effect without waiting for the 60s rebind sweep. "Off"
  never releases the port: gated apps are loopback-pinned, so releasing
  would strand them, not open them.
- security.app-gate-status now reports gate_enabled + any override.
- New guard test pins the `auth: open` set (both entries reviewed); the
  `auth: none` count moves 25 → 26, absorbing pre-existing drift from the
  phoenixd onboarding (loopback JSON API with its own generated password).
- Docs: the manifest spec's ports row documented only host/container/
  protocol — bind, auth, auth_rationale and session_passthrough were
  undocumented. Added a full "Ports & the app gate" section plus a
  developer-guide entry telling app authors to enforce their own auth
  regardless, since the operator can flip the gate either way.

Verified live on archi-dev-box from an external address: gated → 401 gate
page; override off → Gitea 200 own page, BTCPay 302 to its own login,
git-over-HTTP info/refs 200; override on → 401 again; clear → default.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/appgate/identity.rs

@@ -40,6 +40,15 @@ pub struct GatedPort {
     /// companion UIs proxy that cookie to the daemon's authenticated
     /// endpoints; for every other app the gate strips its own credential.
     pub session_passthrough: bool,
+    /// Does the gate challenge for the dashboard login on this port?
+    ///
+    /// Default comes from the manifest (`auth: gated`/undeclared → true,
+    /// `auth: open` → false); the operator's runtime override
+    /// (`app_gate_config`, Settings → app → App gate) wins over both.
+    /// False does NOT release the port — the gate keeps binding and
+    /// proxying (frame-header fixes, app-down page, Tor upstream); it just
+    /// forwards every request to the app's own authentication.
+    pub auth_enabled: bool,
 }
 
 /// A port deliberately left unauthenticated, and the manifest's stated reason.
@@ -187,6 +196,18 @@ pub fn build_port_map() -> PortMap {
         }
     }
 
+    // The operator's runtime override wins over the manifest default, in
+    // both directions: un-gate an app that fronts its own login, or force
+    // the challenge back onto an `auth: open` port. Overrides only toggle
+    // the challenge on gate-fronted ports — they never bind or release
+    // anything, so a stale override cannot expose or strand a port.
+    let overrides = crate::container::app_gate_config::all_gate_overrides();
+    for gp in map.gated.values_mut() {
+        if let Some(enabled) = overrides.get(&gp.app_id) {
+            gp.auth_enabled = *enabled;
+        }
+    }
+
     map.exempt.sort_by_key(|e| e.port);
     map
 }
@@ -229,7 +250,10 @@ fn classify_manifest(manifest: &AppManifest, map: &mut PortMap) {
             // Explicit opt-in: the app is on loopback and the daemon
             // owns the external addresses. This is the ONLY way a
             // port gets bound by the gate, regardless of `bind`.
-            PortAuth::Gated => {
+            // `open` is the same takeover with the login challenge
+            // defaulted off — the app fronts its own authentication
+            // (rationale-required, see PortAuth::Open).
+            PortAuth::Gated | PortAuth::Open => {
                 map.gated.insert(
                     port.host,
                     GatedPort {
@@ -239,6 +263,7 @@ fn classify_manifest(manifest: &AppManifest, map: &mut PortMap) {
                         icon: icon.clone(),
                         declared: true,
                         session_passthrough: port.session_passthrough,
+                        auth_enabled: port.auth_policy() == PortAuth::Gated,
                     },
                 );
             }
@@ -289,6 +314,10 @@ fn classify_manifest(manifest: &AppManifest, map: &mut PortMap) {
                         // An undeclared port never gets the node session —
                         // passthrough is an explicit manifest opt-in only.
                         session_passthrough: false,
+                        // Undeclared ports are challenged wherever the gate
+                        // can stand: reporting-and-protecting is the safe
+                        // default (operator override still applies below).
+                        auth_enabled: true,
                     },
                 );
             }

core/archipelago/src/appgate/mod.rs

@@ -139,6 +139,14 @@ impl AppGate {
         app: &GatedPort,
         client_ip: IpAddr,
     ) -> Response<Body> {
+        // The accept loop captured its GatedPort at bind time; per-request
+        // policy (the operator's gate on/off toggle, session_passthrough)
+        // must come from the live map or a Settings change would only apply
+        // to ports (re)bound after the next sweep. Falls back to the bound
+        // snapshot when the port momentarily leaves the map mid-refresh.
+        let live = self.port_map.read().await.gated(app.port).cloned();
+        let app = live.as_ref().unwrap_or(app);
+
         let path = req.uri().path().to_string();
 
         if let Some(action) = path.strip_prefix(GATE_PREFIX) {
@@ -169,6 +177,17 @@ impl AppGate {
             return proxy_to_app(req, app, true).await;
         }
 
+        // Gate challenge disabled for this app (manifest `auth: open`, or
+        // the operator's Settings toggle): forward everything to the app's
+        // own authentication. The Authorization header passes through
+        // untouched — git clients speak basic-auth to Gitea, API clients
+        // carry the app's own tokens. Gate cookies are still stripped in
+        // proxy_to_app (an ungated app must never see the node session),
+        // and the frame fixes / app-down page still apply.
+        if !app.auth_enabled {
+            return proxy_to_app(req, app, false).await;
+        }
+
         match self.authorize(req.headers(), &app.app_id).await {
             // The credential was a cookie (or none was needed): the
             // Authorization header, if any, belongs to the app. Forward it.
@@ -1164,6 +1183,7 @@ mod tests {
             icon: None,
             declared: true,
             session_passthrough: false,
+            auth_enabled: true,
         }
     }