[Bccorb]

Companion to fells-code/seamless-templates#142 (fells-code/seamless-templates#133), which moves the web and Next.js production images to non-root and port 8080.

Draft on purpose: this cannot pass conformance until seamless-templates#142 is on templates main. Merge order is below.

What changed and why

• src/generators/docker/docker.ts: webService() and fullStackWebService() publish 127.0.0.1:5173:8080. The nginx web service health-checks http://127.0.0.1:8080/health (127.0.0.1 rather than localhost, because busybox wget resolves localhost to ::1 and the template's nginx listens on IPv4 only; this matches the templates' own HEALTHCHECK). The full-stack service health-checks http://localhost:8080/health with fetch. The full-stack service runs the Next.js dev target, which seamless-templates#142 moved to next dev --port 8080.
• src/generators/docker/docker.test.ts: the port assertions move to 8080, plus new assertions on both healthcheck URLs.
• verify/docker-compose.verify.yml: react, angular, vue, svelte, nextjs and nextjs-dev map 5173:8080 and health-check 8080. The react service builds from an inline Dockerfile that copies the template's nginx.conf, so its runtime stage moves to nginxinc/nginx-unprivileged:alpine with the web root owned by nginx, the same as the template Dockerfiles. The *-dev services for vite, Angular, Vue and Svelte were already on 5173:5173 and are unchanged.
• verify/{angular,vue,svelte}-app (the reference apps): moved to nginxinc/nginx-unprivileged:alpine on 8080, because they share the angular / vue / svelte compose services with the templates. They only run when the templates registry has no template for that framework, which is not the case on templates main today.
• Patch changeset.

Not touched: .github/workflows, and the templates pin (SEAMLESS_TEMPLATES_REF / SEAMLESS_TEMPLATES_COMMIT), since no templates release carries the change yet. No README or docs text referred to the container port (they only mention host port 5173, which is unchanged).

Merge order

How each job picks its templates:

• Conformance (conformance.yml calling verify-conformance.yml, here and in every sibling repo) checks out seamless-templates at templates-ref, which is empty in this repo, so it uses templates main, not the pin. seamless-templates' own conformance.yml runs seamless-cli/.github/workflows/verify-conformance.yml@main with cli-ref empty, so it runs this repo's main harness against the templates PR head.
• Scaffolds (seamless init) download templates at the pinned SEAMLESS_TEMPLATES_COMMIT (v0.21.0, still on port 80). No CI job exercises the web container of a scaffold: scaffold-smoke only brings up db and auth, and docker.test.ts asserts strings. ci.yml (build, tests, check:templates-pin) does not care about the port.

So the two PRs deadlock on conformance, in both orders. Whichever merges first does so red, and until the other one merges every conformance run in the ecosystem (seamless-auth-api, seamless-auth-server, the SDK repos, seamless-templates, this repo, and the daily released-smoke) fails the production browser layers: react-vite, react-oauth, angular, vue, svelte, nextjs and, with --dev, nextjs (dev). The api, adapter and vite/Angular/Vue/Svelte dev-server layers are unaffected. The cause is a container listening on one port while compose maps and health-checks the other (or, for the react service once this lands against templates on 80, unprivileged nginx failing to bind port 80), so the service never becomes healthy and its layer fails.

Separately, once this is on main and before the pin bump, a scaffold from main maps 8080 against a v0.21.0 web image that listens on 80, so the generated web service never gets healthy. Nothing in CI catches that, so the CLI must not be released in that window.

Recommended sequence:

1. Merge seamless-templates#142 with its conformance known-red (it runs this repo's main harness, still on 80).
2. Re-run this PR's conformance right away. It should go green against templates main. Mark it ready and merge it immediately, which ends the ecosystem-wide red window.
3. Release seamless-templates (v0.22.0) from its version PR.
4. Bump SEAMLESS_TEMPLATES_REF to v0.22.0 and SEAMLESS_TEMPLATES_COMMIT to its commit (git ls-remote https://github.com/fells-code/seamless-templates 'refs/tags/v0.22.0^{}') in a follow-up PR.
5. Only then merge this repo's version PR. Do not merge it between steps 2 and 4.

Templates first, rather than this first, because then the change pair is validated together by this PR's conformance run before the second merge; in the reverse order the red window is the same length but nothing runs both halves together until after both have merged. If a shorter scaffold gap matters more than the conformance window, the alternative is to hold this PR after step 1 until step 3 and push the pin bump onto it, at the cost of a longer red window across the other repos.

Checks

• npm run build: exit 0.
• npm test: Tests 1482 passed | 4 skipped (1486).
• npm run coverage: All files | 98.88 | 96.24 | 98.36 | 99.22 (statements, branches, functions, lines), thresholds met, exit 0.
• npm run check:templates-pin: SEAMLESS_TEMPLATES_COMMIT matches fells-code/seamless-templates v0.21.0 (abed6be...).
• npm run check:types-current: @seamless-auth/types "^0.33.0" is current (latest 0.33.0).
• docker compose -f verify/docker-compose.verify.yml with every browser profile config --quiet: exit 0.
• docker build --target runtime of verify/vue-app, then docker run -p 127.0.0.1:15173:8080: runs as uid=101(nginx), /health 200, / 200, and the entrypoint-written config.js is served. The Angular and Svelte reference Dockerfiles carry the identical change.
• Conformance is not run locally; it is expected red on this PR until seamless-templates#142 merges.