Service certificates and template imports

v1.66.0

Features

• Traefik certificates available to auxiliary services — in Traefik TLS mode every created or recreated service receives the exact oduflow-traefik-acme volume at /etc/traefik read-only, with no per-service TLS flags or wildcard allowance for other system volumes. Existing services gain the mount on their next update.
• Database-only Odoo template import — oduflow import-template and import_template_from_odoo now accept --without-filestore / without_filestore=True, requesting a PostgreSQL custom-format dump without filestore files and deriving template metadata after restore.
• Attach separate template filestores — new oduflow attach-filestore CLI and attach_filestore MCP tool attach or replace a template filestore after a database-only import. Sources can be local directories, zip/tar archives, rsync:// URLs, or SSH rsync paths; wrapper directories such as the database name are auto-detected and live overlay env changes are preserved by default.

Bug Fixes

• Invalid service volume updates are non-destructive — update_service now resolves the complete candidate volume configuration before stopping the running container, so a missing or reserved volume no longer deletes the service before returning an error.
• Generated PostgreSQL passwords are safe for the Odoo entrypoint — per-environment passwords that randomly began with - were parsed as another CLI option, leaving --db_password without a value and putting the Odoo container into a restart loop. Password generation now retries that rare token shape.
• Odoo template import now refuses existing template names — import-template fails before DB listing or backup download if the target template directory or template database already exists, avoiding accidental overwrites.
• Database-only template import can restore newer custom dumps — when the shared PostgreSQL container's pg_restore cannot read a custom dump archive version, Oduflow converts it to plain SQL with a temporary postgres:17 helper container and restores that SQL through the shared database container.

Documentation & Testing

• Implicit service certificate-store decision record — specs/0032 records the deliberate shared-read, read-only ACME mount and its trust-boundary consequences.