fix(devtools): stabilize Penpot MCP, fix S3 creds, OIDC registration

MCP server:
- Replace vite build --watch + livePreview with static vite preview
  (watch mode was reloading the plugin iframe, killing WebSocket)
- Bake WS_URI at Docker build time for production WebSocket URL
- Add server-side application-level keepalive messages every 25s
- Add client-side auto-reconnect with exponential backoff
- Set Pingora route timeout to 86400s for WebSocket idle tolerance

Penpot:
- Add AWS_ACCESS_KEY_ID/SECRET env vars for S3 SDK compatibility
- Set S3 region to satisfy AWS SDK credential chain
- Enable OIDC registration (disable-registration blocks OIDC signup)
- Fix frontend port (8080 not 80)
- Add penpot bucket to seaweedfs-buckets init job

base/devtools/penpot.yaml

@@ -14,9 +14,11 @@ data:
   PENPOT_ASSETS_STORAGE_BACKEND: "assets-s3"
   PENPOT_STORAGE_ASSETS_S3_ENDPOINT: "http://seaweedfs-filer.storage.svc.cluster.local:8333"
   PENPOT_STORAGE_ASSETS_S3_BUCKET: "penpot"
+  PENPOT_STORAGE_ASSETS_S3_REGION: "us-east-1"
+  AWS_REGION: "us-east-1"
   PENPOT_OIDC_BASE_URI: "https://auth.DOMAIN_SUFFIX/"
   PENPOT_TELEMETRY_ENABLED: "false"
-  PENPOT_FLAGS: "enable-login-with-oidc disable-login-with-password disable-email-verification disable-registration enable-backend-api-doc enable-auto-file-snapshot enable-tiered-file-data-storage enable-webhooks enable-access-tokens enable-cors"
+  PENPOT_FLAGS: "enable-login-with-oidc disable-login-with-password disable-email-verification enable-oidc-registration enable-backend-api-doc enable-auto-file-snapshot enable-tiered-file-data-storage enable-webhooks enable-access-tokens enable-cors"
 ---
 # ── Frontend (nginx SPA) ─────────────────────────────────────────────────────
 apiVersion: apps/v1
@@ -126,6 +128,16 @@ spec:
                 secretKeyRef:
                   name: penpot-s3-credentials
                   key: secret-key
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: penpot-s3-credentials
+                  key: access-key
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: penpot-s3-credentials
+                  key: secret-key
           resources:
             requests:
               cpu: 100m