v1.3.0

BridgePort 1.3.0 makes container operations friendlier in three places: deploys now log into private registries automatically, services keep their identity when you rename them, and the dashboard diagram is finally a pleasure to use. Three database migrations apply automatically on container start.

---

Three migrations are included; all apply automatically on container start with no manual steps.

• 20260521120000_add_server_registry_login — new ServerRegistryLogin table that caches per-(server, registry) login state so deploys can skip redundant docker login calls. (#106)
• 20260522120000_unique_service_container_name — adds @@unique([serverId, containerName]) to Service. Safe over existing data because discovery has always set both fields together. (#116)
• 20260522161709_add_connection_handle_ids — adds sourceHandle / targetHandle columns to ServiceConnection so the diagram can persist which side of a node a connection was drawn from. (#119)

---

BridgePort now runs docker login over SSH on the target server before pulling private images, so operators no longer need to log in by hand on each box. Login state is cached per (server, registry) in the new ServerRegistryLogin table and is automatically invalidated when you edit the registry's token, username, password, registryUrl, or type — metadata-only edits leave the cache intact.

• DigitalOcean, Docker Hub, and generic registries are all supported, with per-type credential mapping.
• Socket-mode deploys (BridgePort talking to a local Docker daemon) skip the persistent-login path and pass auth in-process to dockerode's pull() via authconfig, so no state is written to the BridgePort host.
• Login failure aborts the deploy with docker login failed: <reason> instead of falling through to a misleading "image not found" later.

Service display name and container name are now properly decoupled. Discovery matches Docker containers against the containerName field, so renaming a service to something friendlier (e.g. keycloak-1-production) no longer causes the next scan to create a duplicate row and mark the old one missing.

• The Configure modal has a hint under Container Name explaining that it drives discovery while display name is free-form.
• A new @@unique([serverId, containerName]) constraint enforces the invariant at the database level.
• Docs updated under docs/guides/servers.md and docs/guides/services.md.

---

The topology diagram had two interaction bugs and an unclear discovery model:

• Drag-to-connect was unreliable. Connection handles were 8×8 px, nearly invisible, and connectionMode defaulted to strict — so dragging from one node's right handle to another's right handle (or releasing on the node body instead of the tiny target dot) silently failed.
• The X button on manual edges sometimes did nothing. A stale module-level handler ref meant the delete callback could go missing after re-renders.
• No drag-free alternative. AddConnectionModal existed but wasn't wired up.

This release fixes all three:

• Bigger 10×10 handles that grow to 14×14 with a blue ring on node hover and green when they're a valid drop target. Service and database nodes also gained top/bottom handles, so you can draw connections in any direction.
• connectionMode={Loose} and a 28-pixel snap radius so any handle pair can connect and you don't have to land exactly on the dot.
• Delete callback now flows through edge.data.onDelete (the standard ReactFlow pattern) with optimistic UI — the edge disappears immediately and the API call follows.
• A new + Add Connection button in the diagram toolbar opens AddConnectionModal for a discoverable, drag-free path.

Connection tests against managed Valkey 8 instances (e.g. DigitalOcean Managed Valkey) were failing with a misleading "Connection is closed" because the default-user ACL on those clusters can NOPERM-block INFO server. The test now uses PING for liveness and falls back to INFO only for best-effort version detection. ACL-restricted users also now get their username passed through (matching the postgres/mysql branches), and underlying connection errors surface a real message instead of being eaten by an empty error handler.

---

Internal change to the .claude/commands/release.md workflow so future release notes (like this one) are structured, skimmable, and front-load any "Action required" items rather than dumping a flat list of PR bullets.

src/lib/ssh.ts gained helpers used by the new registry-login flow (writing the password to a 0600 temp file and piping into docker login --password-stdin, never as a CLI argument). Covered by new unit tests in src/lib/ssh.test.ts.