feat: standard DB host ports, expose-by-default, unified provisioning + up/down fixes

[gustavobertoi]

What & why

Builds on #122. Makes shared services reachable on the ports developers already expect, adds the common databases as first-class engines, and fixes the up/down reliability issues rooted in the old dual host-port design.

1. One standard host port per engine — no separate bands

Previously there were two host-port overlays fighting over the same shared containers' ports::

• the expose overlay (standard ports), and
• a separate provisioning band (45xxx via writeProvisionOverlay/engineTarget).

Every provision, db reset, snapshot, resource op and re-up applied a different subset, so compose kept recreating the shared container with a different port set — the root of "port already allocated", connection-reset races, and re-up flakiness.

Now collapsed into one overlay published on the engine's standard 127.0.0.1 port (ensureExposed/primaryExposePort). Provisioning, reset, snapshot and resource ops all resolve their admin endpoint from it — exactly one host port per engine, the well-known one. Idempotent (same ports + same overlay bytes → no recreate). Deleted engineOverlays, writeProvisionOverlay, and the pg-provision/45xxx band.

Engine	Host port
postgres	5432
mysql / mariadb	3306
mongodb	27017
cassandra	9042
arangodb	8529
redis	6379 · minio 9000/9001 · nats 4222 · rabbitmq 5672 · kafka 49092*

_{*kafka keeps its fixed advertised external listener.}

2. Expose by default on up

up auto-publishes every exposable shared engine on its standard loopback port, so GUI clients' defaults just work and provisioning has one port to dial. Opt out with up --no-expose; skipped on remote backends.

3. down actually brings things down + re-up works

• down now stops every shared engine that fell to zero refs (Manager.GC), respecting cross-workspace ref-counting — no more warm engines left running.
• It clears the saga phase records for what it stopped (compose-up per project; shared/provision/resources when the shared stack stops), so the next up restarts them instead of skipping on a stale fingerprint — fixes "re-up after down is a no-op".

4. Five new shared database engines

Built-in templates, each reachable at shared-<name>, exposable, with a connection URL: mysql, mariadb, mongodb, cassandra, arangodb. Plus the devdock-import map and README.

Verification

• End-to-end against a real Docker daemon: up → auto-expose on 127.0.0.1:5432 → provision role/db (psql confirmed) → down stops shared → re-up restarts shared+provision+app and re-publishes ports. Standard ports throughout, zero collisions across the cycle.
• Five new templates lint (compose-go/v2); ${ref} resolves to shared-mysql/3306 etc.
• go vet, gofmt, make determinism, and the race detector on orchestrate/cli pass.

Notes

• Base is fix/expose-wsl2-excluded-ports (fix(expose): skip Windows/Hyper-V excluded port ranges on WSL2 #122) so the diff is scoped — retarget to main once fix(expose): skip Windows/Hyper-V excluded port ranges on WSL2 #122 merges.
• The one pre-existing failing test in the tree (TestRunUninstallSequence) is env leakage from a real ~/.local/bin/ds symlink on the dev machine, unrelated to this change.

🤖 Generated with Claude Code