Add global custom registry authentication

[arjunkomath]

Summary

• add installation-global custom registry credentials with canonical unique hosts and an admin Settings UI
• unify built-in registry credentials with the same encrypted desired-state bundle
• synchronize complete registry state to every registered agent through prioritized, coalesced work-queue wakeups and a signed no-store endpoint
• atomically manage leased Docker auth generations on agents and use them explicitly for Podman, BuildKit, and Crane
• switch control-plane image checks to syntax-only validation; actual agent pulls remain authoritative
• bind signed agent requests to their HTTP method, path/query, and body

Security and lifecycle

• AES-256-GCM with credential-ID/canonical-host AAD
• custom ciphertext remains opaque to control-plane bundle construction
• startup and failed synchronization are fail-closed
• retired plaintext-equivalent Docker auth generations are removed after in-flight leases finish
• unknown registries default to TLS verification enabled

Verification

• cd web && pnpm test — 56 files / 362 tests passed
• cd web && ./node_modules/.bin/tsc --noEmit
• cd agent && go test ./...
• cd agent && go test -race ./internal/registryauth ./internal/agent
• cd agent && go build ./...
• cd agent && gofmt -l .
• git diff --check origin/main...HEAD

Known limitation

Insecure registry policy covers agent-managed Podman pulls, BuildKit exports, and Crane manifest operations. Dockerfile FROM pulls resolved by BuildKit additionally require that insecure host in the BuildKit daemon configuration. TLS-verified private source pulls receive managed credentials normally.

[github-actions]

React Doctor found no issues. 🎉

⚠️ Warning: .github/workflows/react-doctor.yml is configured incorrectly. See below to fix.

React Doctor compares against main to report only the issues this pull request introduces. This run couldn't complete that comparison (usually a shallow CI checkout with no merge base), so it listed every issue in the changed files, including ones that already existed on main.

Add fetch-depth: 0 to the actions/checkout step in .github/workflows/react-doctor.yml so the checkout includes the history React Doctor needs:

 jobs:
   react-doctor:
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0

       - uses: millionco/react-doctor@v2

To silence this warning, set silence-missing-baseline-warning: true on the React Doctor action.

_{Reviewed by React Doctor for commit b383d7b.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
techulus-cloud	🟢 Ready	View Preview	Aug 1, 2026, 1:56 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.