Feat/portal serving

[St4NNi]

Adds artifact-backed portal serving to Aruna nodes. Nodes can now expose the portal from their existing HTTP server, install/update portal release artifacts, report portal runtime status via /api/v1/info, and support local preview/Docker workflows.

Changes

• Adds api_version and portal status fields to GET /api/v1/info.
• Adds portal runtime state to ServerState, including install status, artifact URL, checksum, version/source metadata, fetch timestamp, and last error.
• Adds PORTAL_MODE=disabled|artifact and PORTAL_DIR configuration.
• Supports optional PORTAL_ARTIFACT_URL and optional PORTAL_ARTIFACT_SHA256 pinning for artifact mode.
• Downloads ${PORTAL_ARTIFACT_URL}.sha256 from the release, verifies the tarball against that sidecar, and stores the sidecar in PORTAL_DIR.
• Skips startup download when PORTAL_DIR/index.html already exists, which supports embedded or preinstalled portals.
• Safely unpacks verified portal tarballs by rejecting absolute paths, parent traversal, symlinks, hardlinks, unsupported entries, and archives without index.html.
• Serves the portal from the node HTTP server at / using tower_http::services::ServeDir.
• Adds SPA fallback for client-side routes while preserving REST/API/docs/S3/well-known route boundaries.
• Adds /portal-config.json with runtime API base URL for the built portal.
• Adds Cache-Control: no-cache for portal index/deep-link responses.
• Adds Cache-Control: public, max-age=31536000, immutable for /assets/* files.
• Keeps missing /assets/* files as 404 instead of falling back to the SPA.
• Adds aruna-doctor portal update to force-refresh PORTAL_DIR from the configured or provided portal artifact URL.
• Adds Docker support for embedded portal files via PORTAL_EMBED_DIR, with runtime defaults PORTAL_DIR=/run/portal and configurable PORTAL_MODE.
• Adds just preview and just preview-no-oidc recipes that run local preview clusters with --portal-dir.
• Extends scripts/local_cluster_deploy.sh to pass PORTAL_MODE=artifact, PORTAL_DIR, and local CORS origins into preview nodes.

Resolved Issues

• Resolves [feat] Portal served by the node #257 by serving the portal from the node HTTP server with SPA fallback and portal status reporting.
• Addresses [chore] Packaging and deployment #284 by supporting release-artifact installation, checksum verification via the release .sha256 sidecar, Docker embedding, and local preview deployment flows.
• Follows up on [feat] CORS for REST and S3 #242 for portal preview usage by wiring local REST/S3 CORS origins into the local cluster deploy script when a portal directory is supplied.

Notes

• This intentionally does not revive PORTAL_DIST_PATH; PORTAL_DIR is the configured install/serve directory.
• If PORTAL_DIR already contains index.html, startup serves it immediately and does not download.
• PORTAL_ARTIFACT_SHA256 is optional. When set, it pins the expected checksum from the downloaded .sha256 sidecar.
• The .sha256 file in PORTAL_DIR is used to populate /api/v1/info.portal.checksum for installed or embedded portals.

[das-Abroxas]

I like the idea to give Aruna a clean way to serve an optional portal without hardwiring a frontend directly into the core application. This enables node operators to easily link their custom service to Aruna. Lgtm 👍