Rip out Theia, ship P5.1 attach E2E + Justine UI work-in-progress

Theia rip-out:
- Delete app/api/theia-auth/route.ts (Traefik ForwardAuth shim)
- Delete app/api/projects/[projectId]/workspace/route.ts and
  app/api/projects/prewarm/route.ts (Cloud Run Theia provisioning)
- Delete lib/cloud-run-workspace.ts and lib/coolify-workspace.ts
- Strip provisionTheiaWorkspace + theiaWorkspaceUrl/theiaAppUuid/
  theiaError from app/api/projects/create/route.ts response
- Remove Theia callbackUrl branch in app/auth/page.tsx
- Drop "Open in Theia" button + xterm/Theia PTY copy in build/page.tsx
- Drop theiaWorkspaceUrl from deployment/page.tsx Project type
- Strip Theia IDE line + theia-code-os from advisor + agent-chat
  context strings
- Scrub Theia mention from lib/auth/workspace-auth.ts comment

P5.1 (custom apex domains + DNS):
- lib/coolify.ts + lib/opensrs.ts: nameserver normalization, OpenSRS
  XML auth, Cloud DNS plumbing
- scripts/smoke-attach-e2e.ts: full prod GCP + sandbox OpenSRS +
  prod Coolify smoke covering register/zone/A/NS/PATCH/cleanup

In-progress (Justine onboarding/build, MVP setup, agent telemetry):
- New (justine)/stories, project (home) layouts, mvp-setup, run, tasks
  routes + supporting components
- Project shell + sidebar + nav refactor for the Stackless palette
- Agent session API hardening (sessions, events, stream, approve,
  retry, stop) + atlas-chat, advisor, design-surfaces refresh
- New scripts/sync-db-url-from-coolify.mjs +
  scripts/prisma-db-push.mjs + docker-compose.local-db.yml for
  local Prisma workflows
- lib/dev-bypass.ts, lib/chat-context-refs.ts, lib/prd-sections.ts
- Misc: stories CSS, debug/prisma route, modal-theme, BuildLivePlanPanel

Made-with: Cursor

lib/opensrs.ts

@@ -420,10 +420,11 @@ export async function registerDomain(
   const regUsername = input.regUsername ?? generateHandle(input.domain);
   const regPassword = input.regPassword ?? generateRandomPassword();
 
-  const nameservers =
+  const nameservers = (
     input.nameservers && input.nameservers.length >= 2
       ? input.nameservers
-      : defaultNameservers(cfg.mode);
+      : defaultNameservers(cfg.mode)
+  ).map(ns => ns.trim().replace(/\.+$/, '').toLowerCase());
 
   const contactSet = {
     owner: input.contact,
@@ -492,6 +493,10 @@ export async function updateDomainNameservers(
   if (!nameservers || nameservers.length < 2) {
     throw new Error('At least two nameservers are required');
   }
+  // OpenSRS rejects FQDN-style nameservers (with trailing dot). Cloud DNS
+  // returns NS records as `ns-cloud-eX.googledomains.com.` so we must strip
+  // the trailing dot before handing them to the registrar.
+  const normalized = nameservers.map(ns => ns.trim().replace(/\.+$/, '').toLowerCase());
   const cfg = configFromEnv(overrides);
   const parsed = await rawCall(
     'advanced_update_nameservers',
@@ -499,7 +504,7 @@ export async function updateDomainNameservers(
     {
       domain,
       op_type: 'assign',
-      assign_ns: nameservers,
+      assign_ns: normalized,
     },
     cfg,
   );