feat(ui): attachments pipeline, serialization, git-backed projects, v1 VM lifecycle

[t0kubetsu]

Summary

53 commits extracted from feat/ci-hardening that do not touch CI configuration.

Included work

Attachments pipeline

• Canonical attachment data model: target_node, order_in_stage, content_inline
• useAttachments: create/update/remove/scope/order/source mutators
• validateAttachment + normalizeAttachments; legacy row normalization on read
• AttachmentManager component reads canonical shape
• Round-trip serialization tests; symmetric VLAN injection coverage

Serialization

• Serialize/deserialize coverage broadened; schema/operators CI check

Git-backed projects

• useProjectRepo: authenticate with source PAT, return deployable commit_sha from save()
• GitProviderV1 adapter (GitHub)
• Push canvas topology to git on save; pin deploy SHA

v1 VM lifecycle

• Migrate VM list + lifecycle to v1 API surface; status-aware actions
• Proxy /v1 dev-server to backend
• Invalidate host cache on setBaseUrl

Sources

• Surface write-access badge and gate customize action

Fixes

• Reflect VM lifecycle action in node status badge

Not included

CI workflow changes (.github/workflows/, .github/dependabot.yml) are in the separate feat/ci-hardening PR.