feat(KLEF-204): Namespace aware provisioning

[JeremyNRoos]

Pull Request

Summary

• Refactors workload provisioning to accept namespace-scoped jobs — previously the daemon required project_id on every WorkloadSpec; now jobs with only namespace_id are accepted and routed correctly
• Container names now follow user.namespace.servername format so spawned containers are identifiable and scoped across namespaces without collision
• Adds KLEFF_NODE_NETWORK config to attach all spawned containers to a fixed Docker network alongside the platform API
• Adds Discover() to RuntimeAdapter so the daemon re-adopts existing containers on startup without losing state
• Adds a SQLite-backed ServerRepository adapter for local daemon state persistence

Related Issues

Closes #

---

Changes

What's Included

• internal/application/ports/workload.go — NamespaceID and NamespaceSlug fields on WorkloadSpec; provision validation now accepts namespace-only jobs (no project_id required)
• internal/application/ports/runtime_adapter.go — Discover() method added to RuntimeAdapter interface
• internal/application/ports/server_repository.go — ServerRepository interface (Save, FindByID, UpdateStatus, ListAll)
• internal/adapters/out/runtime/docker/docker.go — user.namespace.servername container naming; KLEFF_NODE_NETWORK network attachment on provision; namespace-scoped Docker network management; Discover() implementation for startup re-adoption
• internal/adapters/out/runtime/kubernetes/kubernetes.go — stub Discover() to satisfy interface
• internal/adapters/out/repository/sqlite/server_repository.go — SQLite adapter: upsert on Save, FindByID, UpdateStatus, ListAll
• internal/app/config/config.go — NodeNetwork field read from KLEFF_NODE_NETWORK env var
• cmd/kleffd/main.go — wires NodeNetwork config; calls Discover() on startup to re-adopt existing containers
• cmd/kleffctl/main.go — updated for port interface changes
• pkg/labels/labels.go + labels_test.go — kleff.io/namespace_id label added; label builder updated
• internal/workers/provision_worker.go, start_worker.go, stop_worker.go, restart_worker.go, delete_worker.go — all workers propagate NamespaceID/NamespaceSlug through to runtime calls
• internal/workers/mocks_test.go — updated mocks for new interface
• internal/logs/tailer.go, internal/metrics/scraper.go — updated for new WorkloadSpec shape

What's Not Included

• SQLite schema migrations / DDL (tracked separately — schema is initialized separately from the adapter)
• Kubernetes namespace-scoped networking (stub only; Kubernetes runtime is not in active use)
• Daemon-side metrics persistence (scraper updated but storage backend unchanged)

---

Testing

How Was This Tested?

• Daemon started locally against kleff-local network; namespace-scoped provision job dispatched via platform API; container confirmed on correct network with name in user.namespace.servername format
• Discover() on daemon restart re-adopted a pre-existing container; subsequent stop/delete operations succeeded
• Worker unit tests pass with updated mocks

Test Coverage

• Unit tests added or updated
• Integration tests added or updated
• Manually tested end-to-end

---

Breaking Changes

Does this PR introduce breaking changes?

• Yes
• No

If yes, describe the impact and any required migration steps:

WorkloadSpec gains NamespaceID and NamespaceSlug fields — callers that construct WorkloadSpec directly must be updated. The platform API already sends these fields as of the companion panel PR. RuntimeAdapter gains Discover() — any additional runtime implementations must add this method.

---

Security Considerations

• This PR affects authentication or authorization logic
• This PR touches secrets, tokens, or environment variables
• This PR affects infrastructure, deployment pipelines, or network configuration

If any box is checked, describe the security impact and any mitigations applied:

Containers are attached to the network named by KLEFF_NODE_NETWORK. In production this must be a restricted internal overlay network accessible only to the platform API and daemon. For local dev the default is kleff-local. Do not expose this network to untrusted services.

---

Documentation

Does this PR require documentation updates?

• Yes
• No

If yes, check all that apply:

• README.md
• ARCHITECTURE.md
• API reference
• Architecture diagrams (C4 / DDD)
• /docs

---

UI/UX (If Applicable)

• Includes new components or views
• Changes styles or theme tokens
• Responsive behavior verified
• Requires design approval

Screenshots or recordings:

---

Pre-Merge Checklist

• PR title follows semantic format (feat:, fix:, chore:, docs:, refactor:, test:)
• All CI checks passing
• Code follows project style guidelines
• No debug logs or commented-out code left in
• Dependencies reviewed (no unnecessary additions)
• No sensitive information included

---

Reviewer Notes