docs: bump AI_CAPABILITIES.md to MCP v2.4.5 + bump vibn-frontend submodule

Made-with: Cursor

AI_CAPABILITIES.md

@@ -587,7 +587,7 @@ The MCP descriptor at `GET /api/mcp` reports a semver `version`. Tool names
 are append-only within a major version — agents can cache the tool list
 safely for the duration of a conversation but should re-fetch on 404.
 
-Current version: **2.4.2**.
+Current version: **2.4.5**.
 
 - **1.x** — session-cookie-only MCP, no tenant keys.
 - **2.0** — `vibn_sk_…` keys, workspace-scoped Gitea bot + Coolify project.
@@ -615,6 +615,45 @@ Current version: **2.4.2**.
   to re-run `apps.containers.up` later. This matches the real-world
   behavior of slow-booting apps like Twenty (worker waits ~3 min for
   twenty's healthcheck, exceeds compose's default depends_on timeout).
+- **2.4.3** — Auto-attached stack containers to the `coolify` proxy network
+  after `compose up`, fixing Traefik 503s on third-party apps.
+- **2.4.4** — Made the proxy-network attach selective (only `traefik.enable=true`
+  containers) to avoid DNS aliasing collisions where Twenty's `postgres`
+  hostname resolved to `coolify-db`.
+- **2.4.5** — Architectural overhaul of `apps.create` for service templates.
+  We no longer run `docker compose up -d` over SSH as a deployment fallback
+  (that bypassed Coolify's compose generation, causing internal services to
+  land on the wrong networks). Instead `apps.create` now:
+  1. Calls Coolify's `start` and lets its queue do the full deploy
+     (volumes, internal networking, env interpolation, healthchecks).
+  2. Polls `service.applications[*].status` (the truthful per-app status
+     field — `service.status` itself routinely lies as
+     `starting:unknown` while containers are healthy).
+  3. Applies three surgical post-deploy fixes that Coolify's own
+     pipeline omits but its REST API does not expose:
+       - rewrites `SERVICE_FQDN_*` / `SERVICE_URL_*` in the rendered
+         `.env` so frontends that bake their backend URL into the SPA
+         bundle (Twenty's `SERVER_URL`, etc.) point at the real
+         custom domain instead of the auto-generated sslip.io URL;
+       - injects the missing
+         `traefik.http.services.<svc>.loadbalancer.server.port` label
+         (Coolify generates the routing rules but forgets the port,
+         so Traefik logs `error: port is missing` and returns 503);
+       - connects `coolify-proxy` to the project's Docker network
+         (Coolify writes a `caddy_ingress_network=<uuid>` hint label
+         but never actually runs `docker network connect`), then
+         force-recreates ONLY the public-facing container so the new
+         env+label apply, and restarts the proxy so Traefik
+         re-discovers.
+
+  The response shape gains:
+    - `reachable` — boolean, true when `https://<fqdn>` answers 2xx/3xx
+    - `appStatus` — the truthful per-application status from Coolify
+    - `postDeploy` — step-by-step diagnostic for each of the three fixes
+  The previous `started`/`startMethod`/`startDiag` fields are kept for
+  back-compat. Internal services (Postgres, Redis, worker) stay on
+  their isolated project network — fixing the `password authentication
+  failed` regression introduced in 2.4.4.
 
 ---