feat: deploy portable workspace registry

deploy/thothii.env.example

@@ -20,3 +20,13 @@ THT_OLLAMA_URL=http://host.docker.internal:11434
 # --- Backend ---
 AUTH_MODE=none                 # none | mock | oidc (in embedded l'auth è al bordo del portale)
 MAX_PI_PROCESSES=4
+
+# --- Git-backed workspace registry (no secret values belong in this file) ---
+THT_WORKSPACE_REGISTRY_ROOT=/data/workspace-registry
+THT_WORKSPACE_GIT_BRANCH=main
+THT_WORKSPACE_INSTALLATION_ID=server
+# THT_WORKSPACE_GIT_REMOTE=ssh://git@your-git-host/your-org/thoth-workspaces.git
+# THT_WORKSPACE_GIT_CREDENTIALS_FILE=/absolute/path/to/git-credentials
+# THT_WORKSPACE_GIT_CA_FILE=/absolute/path/to/git-ca.pem
+# THT_WORKSPACE_GIT_SSH_KEY_FILE=/absolute/path/to/git-ssh-key
+# THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE=/absolute/path/to/git-known-hosts

deploy/workspace-registry.env.example

@@ -0,0 +1,15 @@
+# Copy these non-secret registry settings into the installation environment.
+# Create the referenced credential, CA, SSH-key, and known-hosts files locally with restrictive
+# permissions. Their contents are never committed, emitted by the API, or stored in the registry.
+THT_WORKSPACE_REGISTRY_ROOT=/data/workspace-registry
+THT_WORKSPACE_GIT_BRANCH=main
+THT_WORKSPACE_INSTALLATION_ID=local
+THT_WORKSPACE_GIT_AUTHOR_NAME=Thoth Workspace Registry
+THT_WORKSPACE_GIT_AUTHOR_EMAIL=thoth-workspace-registry@localhost
+
+# Set the remote for this installation; use its own SSH/HTTPS address, never an application endpoint.
+# THT_WORKSPACE_GIT_REMOTE=ssh://git@your-git-host/your-org/thoth-workspaces.git
+# THT_WORKSPACE_GIT_CREDENTIALS_FILE=/absolute/path/to/git-credentials
+# THT_WORKSPACE_GIT_CA_FILE=/absolute/path/to/git-ca.pem
+# THT_WORKSPACE_GIT_SSH_KEY_FILE=/absolute/path/to/git-ssh-key
+# THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE=/absolute/path/to/git-known-hosts