## Split

This PR is the frontend contract-fix layer. The Docker packaging work is
stacked separately in #730.

```text
main
  |
  v
#729 dashboard/API contract fixes
  |
  v
#730 monorepo Docker packaging
```

## Problem

The dashboard was still using several assumptions from the older API/SDK
shape. Once the API/dashboard were built through the production path,
those mismatches became hard build blockers.

```text
Generated API / SDK surface
  |
  |-- CreateBox request expects resources.{cpu,memory,disk}
  |-- Box API exposes start/delete/recover/stop as distinct methods
  |-- BoxState no longer has BUILD_FAILED / BUILDING_ARTIFACT / PENDING_BUILD
  |-- Runner DTO no longer exposes currentArtifactCount
  v
Dashboard stale call sites
  |
  |-- cpu/memory/disk sent at top level
  |-- copied mutation hooks exported the wrong hook names/actions
  |-- UI referenced removed BoxState enum values
  |-- Runner details rendered a removed field
  v
Dashboard typecheck / production build failure
```

## What Changed

```text
CreateBoxSheet
  cpu, memory, disk
      -> resources.cpu, resources.memory, resources.disk

Box mutation hooks
  useStartBoxMutation   -> boxApi.startBox
  useDeleteBoxMutation  -> boxApi.deleteBox
  useRecoverBoxMutation -> boxApi.recoverBox
  useStopBoxMutation    -> boxApi.stopBox + detailRef invalidation

Box state UI
  removed stale generated enum references
  added UNKNOWN_DEFAULT_OPEN_API handling

Runner details
  removed currentArtifactCount display
```

## Why This Is Separate

This PR only makes the dashboard match the current generated API/SDK
contract. It does not change Docker, Nx, SST, package layout, or runtime
image packaging. That keeps the frontend compile fixes reviewable before
#730 changes the build pipeline.

## Validation

```text
yarn tsc --project dashboard/tsconfig.app.json --noEmit
NX_DAEMON=false NX_SKIP_NX_CACHE=true \
  VITE_BASE_API_URL=%BOXLITE_BASE_API_URL% \
  yarn nx build dashboard --configuration=production --nxBail=true --output-style=stream
```

Result: dashboard typecheck and production build pass. Existing
Vite/OpenTelemetry/chunk-size warnings still appear, but the build exits
successfully.

The pre-commit lint-fix hook runs `make lint:fix` repo-wide. Nine apps/api
TypeScript files and four apps/runner Go files on the #730 baseline don't
match the fixer's output (CI lints only changed files, so drift
accumulated), so every commit reproduces this churn and aborts. Commit the
fixer's own output once to clear the loop; verified idempotent.

…rt PRIMARY TD

Two fixes from run #38's symptoms:

1. Dockerfile.source ts-node startup failed with:
     TS5083: Cannot read file '/boxlite/apps/tsconfig.base.json'
   Root cause: codex PR #730 (Normalize monorepo Docker build paths)
   moved the apps Nx workspace root from repo-root to apps/. After
   that, apps/api/tsconfig.json's `extends: ../tsconfig.base.json`
   resolves to apps/tsconfig.base.json (not the repo-root one).
   Dockerfile.source still placed it at /boxlite/ with WORKDIR /boxlite,
   so the extends never resolved.

   Fix: mirror the codex production Dockerfile layout — WORKDIR
   /boxlite/apps, place tsconfig.base.json there, COPY apps/api/ to
   api/ and apps/libs/ to libs/. ENTRYPOINT paths drop the apps/
   prefix (api/tsconfig.app.json, api/src/main.ts).

2. Deploy-Api step false-positive:
   ECS DeploymentCircuitBreaker auto-rolled back the broken Api:20
   task definition, leaving the service stable on the previous
   Api:16. `aws ecs wait services-stable` returned success, ALB
   targets stayed healthy (old tasks were never deregistered), and
   /api/health responded 2xx — all answering from the OLD image.
   The workflow believed the deploy succeeded; pytest then ran
   against the old API, masking the broken new image.

   Fix: after `wait services-stable`, query the PRIMARY deployment's
   taskDefinition and assert it equals NEW_TD_ARN. If different,
   ECS rolled back — fail the step and dump stop reasons from the
   most recent stopped tasks for diagnosis.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…norepo layout (#730)

Merging the substantive bits of #745 and #746 here so PR #724's
deploy-app-services CI can actually push an otel-collector image:

* otel-collector/builder-config.yaml: fix module paths after #730
  moved everything under apps/ (was: ../../../api-client-go etc.,
  now: ../../../apps/api-client-go). The OCB build was failing with
  `filepath does not exist: /boxlite/otel-collector/exporter`. (#745)
* otel-collector/Dockerfile: apk add python3 make g++ so node-gyp
  can compile any musl-incompatible native add-on during workspace
  `yarn install`. Kept even after dropping dockerode below — small
  safety net in case future deps reintroduce a native build. (#745)
* apps/package.json: drop unused dockerode + @types/dockerode. They
  were inherited from the Daytona import in #460 but never imported
  in source. Drops the dockerode -> docker-modem -> ssh2 ->
  cpu-features chain; cpu-features was the optional native addon
  that forced the toolchain workaround in the first place. (#746)
* apps/yarn.lock: regenerated (-161 lines).
* apps/api-client-go/api/openapi.yaml: regenerate to catch up with
  main's existing `assignedRoleIds.default: []` drift so the
  api-client-drift PR check passes.