feat: add interactive templating workflows

[machado144]

Summary

Adds hardened templating workflows plus interactive single-binary surfaces for previewing and applying template values.

Tasklist

• Fix config default handling so setup values are honored unless flags are explicitly set
• Fix clone branch behavior and validate required clone inputs
• Make clone/generate dry-runs avoid leaving output directories behind
• Harden placeholder parsing, malformed transforms, ignore globs, .tpl collisions, and file permission preservation
• Add a shared internal/workflow layer over the existing parser, replacer, and cloner services
• Add Seedstorm-style serve command with embedded templates/static assets in the same binary
• Add Local, Clone, and Generate workflows to serve
• Add evaluated transform previews, file-level placeholder trees, idle preview refresh, and searchable saved presets
• Add IndexedDB preset storage with JSON import/export
• Add a safe tui command that previews before writing and supports dry-run
• Add focused tests for config, dry-run, branch, permissions, transform errors, serve scan/apply/clone/generate/evaluate, and TUI dry-run
• Upgrade vulnerable dependencies and pin Go toolchain to 1.25.10
• Update README, user docs, AI architecture docs, COMMANDS.md, and EXAMPLES.md for serve, tui, and shared workflow behavior

Serve UI

The workbench binds to 127.0.0.1:17817 by default and supports:

• local directory scan/apply via --dir
• direct clone from SSH or HTTPS URLs through the existing GitCloner
• generate from configured templates and GitHub-discovered templates
• preview paths that do not write output
• file trees showing where each placeholder appears
• evaluated transform previews such as APP_NAME:toUpperCase -> MYAPP
• saved presets stored locally in browser IndexedDB
• search/filter for saved presets by repo/template/branch/output/value keys
• JSON import/export for saved presets

Screenshot

A current serve UI screenshot should be attached here before merge. GitHub requires an uploaded/hosted image URL for inline rendering, so the screenshot from the review thread can be pasted into this section from the PR editor.

Notes

The new interactive surfaces call the shared workflow layer over the existing services, so CLI, TUI, and serve use the same scan/apply/clone/generate behavior instead of separate implementations.

serve remains local-first and private by default. Saved presets are browser-local unless manually exported.

Verification

• node --check internal/web/static/app.js
• go test ./services ./internal/workflow ./internal/web
• go test ./...
• govulncheck ./...

Check Status

All required PR checks pass. The AI reviewer job is allowed to continue on error because the configured AI API key is currently stale.

[github-actions]

Invalid PR Title

PR title must follow the Conventional Commits format since we use squash merge:

<type>[optional scope][!]: <description>

Allowed types: feat, fix, docs, style, refactor, test, chore, build, ci, perf, revert

Examples:

• feat: add new feature
• fix(api): resolve null pointer
• feat!: breaking change
• chore(deps): update dependencies

[github-actions]

StructLint — All checks passed

84 rules validated against .structlint.yaml. No violations found.

_{View full run · Powered by StructLint}