Merge develop into main

Consolidate all feature and fix branches into main:
- feat: orchestrator observability + mosaic rails integration (#422)
- fix: post-422 CI and compose env follow-up (#423)
- fix: orchestrator startup provider-key requirements (#425)
- fix: BetterAuth OAuth2 flow and compose wiring (#426)
- fix: BetterAuth UUID ID generation (#427)
- test: web vitest localStorage/file warnings (#428)
- fix: auth frontend remediation + review hardening (#421)
- Plus numerous Docker, deploy, and auth fixes from develop

Lockfile conflict resolved by regenerating from merged package.json.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker/api.yml

@@ -113,7 +113,7 @@ steps:
       ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
     commands:
       - *use_deps
-      - pnpm --filter "@mosaic/api" exec vitest run --exclude 'src/auth/auth-rls.integration.spec.ts' --exclude 'src/credentials/user-credential.model.spec.ts' --exclude 'src/job-events/job-events.performance.spec.ts' --exclude 'src/knowledge/services/fulltext-search.spec.ts'
+      - pnpm --filter "@mosaic/api" exec vitest run --exclude 'src/auth/auth-rls.integration.spec.ts' --exclude 'src/credentials/user-credential.model.spec.ts' --exclude 'src/job-events/job-events.performance.spec.ts' --exclude 'src/knowledge/services/fulltext-search.spec.ts' --exclude 'src/mosaic-telemetry/mosaic-telemetry.module.spec.ts'
     depends_on:
       - prisma-migrate
 
@@ -155,7 +155,7 @@ steps:
         elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
           DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-api:dev"
         fi
-        /kaniko/executor --context . --dockerfile apps/api/Dockerfile $DESTINATIONS
+        /kaniko/executor --context . --dockerfile apps/api/Dockerfile --snapshot-mode=redo $DESTINATIONS
     when:
       - branch: [main, develop]
         event: [push, manual, tag]

.woodpecker/coordinator.yml

@@ -95,7 +95,7 @@ steps:
         elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
           DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-coordinator:dev"
         fi
-        /kaniko/executor --context apps/coordinator --dockerfile apps/coordinator/Dockerfile $DESTINATIONS
+        /kaniko/executor --context apps/coordinator --dockerfile apps/coordinator/Dockerfile --snapshot-mode=redo $DESTINATIONS
     when:
       - branch: [main, develop]
         event: [push, manual, tag]

.woodpecker/infra.yml

@@ -39,7 +39,7 @@ steps:
         elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
           DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-postgres:dev"
         fi
-        /kaniko/executor --context docker/postgres --dockerfile docker/postgres/Dockerfile $DESTINATIONS
+        /kaniko/executor --context docker/postgres --dockerfile docker/postgres/Dockerfile --snapshot-mode=redo $DESTINATIONS
     when:
       - branch: [main, develop]
         event: [push, manual, tag]
@@ -64,7 +64,7 @@ steps:
         elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
           DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-openbao:dev"
         fi
-        /kaniko/executor --context docker/openbao --dockerfile docker/openbao/Dockerfile $DESTINATIONS
+        /kaniko/executor --context docker/openbao --dockerfile docker/openbao/Dockerfile --snapshot-mode=redo $DESTINATIONS
     when:
       - branch: [main, develop]
         event: [push, manual, tag]

.woodpecker/orchestrator.yml

@@ -112,7 +112,7 @@ steps:
         elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
           DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-orchestrator:dev"
         fi
-        /kaniko/executor --context . --dockerfile apps/orchestrator/Dockerfile $DESTINATIONS
+        /kaniko/executor --context . --dockerfile apps/orchestrator/Dockerfile --snapshot-mode=redo $DESTINATIONS
     when:
       - branch: [main, develop]
         event: [push, manual, tag]

.woodpecker/web.yml

@@ -123,7 +123,7 @@ steps:
         elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
           DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-web:dev"
         fi
-        /kaniko/executor --context . --dockerfile apps/web/Dockerfile --build-arg NEXT_PUBLIC_API_URL=https://api.mosaicstack.dev $DESTINATIONS
+        /kaniko/executor --context . --dockerfile apps/web/Dockerfile --snapshot-mode=redo --build-arg NEXT_PUBLIC_API_URL=https://api.mosaicstack.dev $DESTINATIONS
     when:
       - branch: [main, develop]
         event: [push, manual, tag]