Cover container setup settings contracts (codex)

[numnx]

🧩 Task: Cover container setup settings contracts

Automated task PR opened by Code UX for T04.

📋 Summary

Sprint: Sprint 139 · Settings mcp and & custom container · Task: T04

Improve Settings so operators can configure HTTP MCP servers with clear guidance and choose a custom container setup script through a file-picker field.

📝 Full Task Prompt

## Objective
Lock down the backend settings behavior for custom container setup scripts so the new picker remains a UI affordance over the existing persisted `cliWorkflow.containerSetupScriptPath` contract.

## Scope
- `tests/backend/domain/settings/settings-sanitizers/cli-workflow-sanitizer.test.ts`
- `tests/backend/domain/settings/settings-schema.test.ts`
- `tests/backend/repositories/settings-sanitizer.test.ts` if existing coverage for dashboard defaults lives there
- `docs/settings/configuration-and-storage.md`

## Implementation Requirements
1. Add sanitizer regression tests proving `containerSetupScriptPath` trims surrounding whitespace, accepts an empty string, preserves relative paths, and preserves absolute paths without requiring the file to exist at settings-save time.
2. Add schema validation coverage proving non-string `containerSetupScriptPath` values are rejected while valid strings pass with the existing `cliWorkflow` object.
3. Confirm default settings still use an empty `containerSetupScriptPath`, `containerCacheSetupScriptImage: true`, and `containerInstallPlaywrightBrowsers: true`; add a focused assertion if not already present.
4. Update `docs/settings/configuration-and-storage.md` to distinguish picker selection from runtime resolution: the picker selects local absolute paths from allowed roots, while manual relative paths are still resolved later by Docker runtime against repo/root/default script locations.

## Constraints
- Do not require the setup script path to exist during settings validation or sanitization.
- Do not change `DEFAULT_DASHBOARD_SETTINGS` unless a failing test reveals an existing incorrect default.
- Do not edit dashboard picker UI in this task; that belongs to T02.
- Preserve backward compatibility for partial persisted settings objects.

## Verification
- Run `pnpm exec vitest run tests/backend/domain/settings/settings-sanitizers/cli-workflow-sanitizer.test.ts tests/backend/domain/settings/settings-schema.test.ts tests/backend/repositories/settings-sanitizer.test.ts`.
- Run `pnpm run test:backend`.
- Run `pnpm run lint`.
- Success means settings validation/sanitization preserves all supported setup script path forms and backend tests pass.

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.5

⏱️ Timing

Started	2026-07-06 09:48:49 UTC
Finished	2026-07-06 09:52:08 UTC
Duration	3m 19s

📊 Token Usage

Metric	Value
Input tokens	115,952
Cached input tokens	513,792
Output tokens	3,887
Total tokens	633,631
Invocations	1
Tool calls	26
Active time	2m 30s

Included usage estimate (subscription/local login): $0.95

🌿 Branch Info

Base: feature/CODUX-139-settings-mcp-and-custom-container
Head: task/feature-codux-139-settings-mcp-and-custom-contai-t04-codex-mr91fhap

---

🤖 Generated by Code UX