fix(devtools): stabilize Penpot MCP, fix S3 creds, OIDC registration

MCP server:
- Replace vite build --watch + livePreview with static vite preview
  (watch mode was reloading the plugin iframe, killing WebSocket)
- Bake WS_URI at Docker build time for production WebSocket URL
- Add server-side application-level keepalive messages every 25s
- Add client-side auto-reconnect with exponential backoff
- Set Pingora route timeout to 86400s for WebSocket idle tolerance

Penpot:
- Add AWS_ACCESS_KEY_ID/SECRET env vars for S3 SDK compatibility
- Set S3 region to satisfy AWS SDK credential chain
- Enable OIDC registration (disable-registration blocks OIDC signup)
- Fix frontend port (8080 not 80)
- Add penpot bucket to seaweedfs-buckets init job

base/devtools/penpot-mcp.Dockerfile

@@ -1,12 +1,12 @@
 FROM node:22-alpine
-RUN npm install -g pnpm@latest @penpot/mcp@latest && \
-    cd /usr/local/lib/node_modules/@penpot/mcp && \
-    pnpm -r install && \
-    pnpm run build
+ARG WS_URI=wss://mcp-designer.sunbeam.pt/ws
+RUN npm install -g pnpm@latest
+COPY . /opt/penpot-mcp/
+WORKDIR /opt/penpot-mcp
+RUN WS_URI=$WS_URI pnpm -r install && WS_URI=$WS_URI pnpm run build
 ENV PENPOT_MCP_REMOTE_MODE=true \
     PENPOT_MCP_SERVER_HOST=0.0.0.0 \
     PENPOT_MCP_SERVER_PORT=4401 \
     PENPOT_MCP_WEBSOCKET_PORT=4402
-EXPOSE 4401 4402
-WORKDIR /usr/local/lib/node_modules/@penpot/mcp
+EXPOSE 4400 4401 4402
 CMD ["pnpm", "run", "start"]

base/devtools/penpot-mcp.yaml

@@ -25,6 +25,8 @@ spec:
               containerPort: 4401
             - name: ws
               containerPort: 4402
+            - name: plugin
+              containerPort: 4400
           env:
             - name: PENPOT_MCP_REMOTE_MODE
               value: "true"
@@ -32,6 +34,10 @@ spec:
               value: "0.0.0.0"
             - name: PENPOT_MCP_SERVER_ADDRESS
               value: "mcp-designer.DOMAIN_SUFFIX"
+            - name: WS_URI
+              value: "wss://mcp-designer.DOMAIN_SUFFIX/ws"
+            - name: PENPOT_MCP_PLUGIN_SERVER_HOST
+              value: "0.0.0.0"
           resources:
             requests:
               cpu: 50m
@@ -54,3 +60,6 @@ spec:
     - name: ws
       port: 4402
       targetPort: ws
+    - name: plugin
+      port: 4400
+      targetPort: plugin

base/devtools/penpot.yaml

@@ -14,9 +14,11 @@ data:
   PENPOT_ASSETS_STORAGE_BACKEND: "assets-s3"
   PENPOT_STORAGE_ASSETS_S3_ENDPOINT: "http://seaweedfs-filer.storage.svc.cluster.local:8333"
   PENPOT_STORAGE_ASSETS_S3_BUCKET: "penpot"
+  PENPOT_STORAGE_ASSETS_S3_REGION: "us-east-1"
+  AWS_REGION: "us-east-1"
   PENPOT_OIDC_BASE_URI: "https://auth.DOMAIN_SUFFIX/"
   PENPOT_TELEMETRY_ENABLED: "false"
-  PENPOT_FLAGS: "enable-login-with-oidc disable-login-with-password disable-email-verification disable-registration enable-backend-api-doc enable-auto-file-snapshot enable-tiered-file-data-storage enable-webhooks enable-access-tokens enable-cors"
+  PENPOT_FLAGS: "enable-login-with-oidc disable-login-with-password disable-email-verification enable-oidc-registration enable-backend-api-doc enable-auto-file-snapshot enable-tiered-file-data-storage enable-webhooks enable-access-tokens enable-cors"
 ---
 # ── Frontend (nginx SPA) ─────────────────────────────────────────────────────
 apiVersion: apps/v1
@@ -126,6 +128,16 @@ spec:
                 secretKeyRef:
                   name: penpot-s3-credentials
                   key: secret-key
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: penpot-s3-credentials
+                  key: access-key
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: penpot-s3-credentials
+                  key: secret-key
           resources:
             requests:
               cpu: 100m