fix(templates): make the shipped templates match reality

The templates are what `create server --from-template` builds from and what
mcpd seeds on start, so drift there ships broken servers. Nothing ever read
these files in a test, and they had rotted badly.

- grafana: GRAFANA_URL now defaults to the in-cluster ClusterIP and the
  description spells out why the public hostname is wrong — reaching a
  co-located Grafana over its ingress hairpins through the per-host Envoy L7
  policy, which drops the caller's identity and returns a bare `Access denied`
  403 with a perfectly valid token. That cost a day of looking at the token.
- unifi-network: was wrong on every field that mattered. `runtime: python`
  for an npm package, an env contract (UNIFI_HOST/USERNAME/PASSWORD) the
  package doesn't read, and no probe. Now UNIFI_TARGETS with the
  classic-vs-unifi_os distinction and the :8443 egress caveat written down.
- docmost, gitea: both carried "health check disabled" comments citing a
  limitation of the old docker-exec probe, which readiness-via-proxy removed.
  Both probes verified against the live servers. gitea uses search_repos, not
  get_me, because get_me needs a `read:user` scope a repo-scoped token lacks.
- filesystem: packageName was `@anthropic/filesystem-mcp`, which 404s on npm —
  the template could never have installed. Points at the real package.
- terraform: deleted. `@anthropic/terraform-mcp` 404s too and there is no
  npm-published replacement to point it at.
- node-red: deleted, the service is gone.

Two supporting fixes:
- The seeder declared no `runtime` field and never wrote the column, so a
  template asking for the python runner silently seeded as null and got node.
- A new templates test reads every shipped file: schema-valid, a runner the
  orchestrator knows, some way to actually start, unique env names, and a
  readiness probe (without one an instance can only ever report `live`).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114dg56YmVacyqhp5fitcTb

templates/unifi-network.yaml

@@ -1,25 +1,42 @@
 name: unifi-network
-version: "1.0.0"
+version: "2.0.0"
 description: UniFi Network MCP server for managing UniFi network devices, clients, and configuration
 packageName: "unifi-network-mcp"
-runtime: python
+runtime: node
 transport: STDIO
 repositoryUrl: https://github.com/sirkirby/unifi-mcp
-# Health check disabled: STDIO health probe requires packageName (npm-based servers).
-# This server uses the Python runner. Probe support for Python runner STDIO servers is TODO.
+healthCheck:
+  # list_sites calls the controller (/api/self/sites), so a pass proves the
+  # whole path: egress to the controller port, TLS, login, session. The old
+  # template disabled the probe entirely on the belief that STDIO probes only
+  # worked for npm packages — that stopped being true once readiness probes
+  # started going through the MCP proxy, and the gap let this server sit at
+  # "healthy" for months without ever reaching the controller.
+  tool: list_sites
+  arguments: {}
+  intervalSeconds: 60
+  timeoutSeconds: 15
 env:
-  - name: UNIFI_HOST
-    description: UniFi controller hostname or IP (e.g. unifi.example.com — without https://)
+  - name: UNIFI_TARGETS
+    description: >-
+      JSON array of controllers. One object per controller:
+      {"id", "base_url", "controller_type", "default_site", "auth":
+      {"username","password"}, "verify_ssl"}.
+
+      controller_type is "classic" for a self-hosted UniFi Network controller
+      (login /api/login, no path prefix) or "unifi_os" for a UDM/UniFi OS
+      console (login /api/auth/login, API under /proxy/network). Choosing the
+      wrong one sends every request to a path that 404s while the server still
+      starts cleanly.
+
+      base_url must carry the real controller port — a self-hosted controller
+      is usually :8443, and :443 on the same host is often an unrelated
+      service. Note that MCP server pods only egress 80/443 by default, so any
+      other port needs an explicit NetworkPolicy (Pulumi
+      `mcpctl.serverEgressTargets`).
     required: true
-  - name: UNIFI_USERNAME
-    description: UniFi local admin username
-    required: true
-  - name: UNIFI_PASSWORD
-    description: UniFi admin password
-    required: true
-  - name: UNIFI_NETWORK_PORT
-    description: UniFi controller port (default 443, use 8443 for standalone UniFi Controller)
-    required: false
-  - name: UNIFI_NETWORK_VERIFY_SSL
-    description: Verify SSL certificate (true/false, default true — set false for self-signed certs)
-    required: false
+    defaultValue: >-
+      [{"id": "home", "base_url": "https://unifi.example.com:8443",
+      "controller_type": "classic", "default_site": "default",
+      "auth": {"username": "CHANGE_ME", "password": "CHANGE_ME"},
+      "verify_ssl": false}]