feat(auth): surface manifest has_auth/public_key and ensure shared auth running

Parse has_auth/public_key from the service manifest onto Container
(persisted to InstalledMetadata), fetch manifests for running non-db
containers during reconciliation, hide role=auth containers from the
grid, and ensure dcntrlized-auth starts with the shared database.

src/lib/containers/watcher.go

@@ -110,9 +110,13 @@ func (cache *ContainerCache) WatchContainers(ctx context.Context, dc *docker.Doc
 					ver = existing.Version
 				}
 				capabilities := existing.Capabilities
+				hasAuth := existing.HasAuth
+				publicKey := existing.PublicKey
 				if manifest != nil {
 					capabilities = manifest.Capabilities
-					updateInstalledMetadataCapabilities(serviceLabel, manifest.Capabilities)
+					hasAuth = manifest.HasAuth
+					publicKey = manifest.PublicKey
+					updateInstalledMetadataFromManifest(serviceLabel, manifest)
 				}
 				container := types.Container{
 					ID:           containerID,
@@ -126,6 +130,8 @@ func (cache *ContainerCache) WatchContainers(ctx context.Context, dc *docker.Doc
 					Role:         role,
 					Hidden:       existing.Hidden || event.Actor.Attributes["org.dcntrlized.hidden"] == "true",
 					Capabilities: capabilities,
+					HasAuth:      hasAuth,
+					PublicKey:    publicKey,
 					Title:        existing.Title,
 					Vendor:       existing.Vendor,
 					Author:       existing.Author,
@@ -241,6 +247,19 @@ func (cache *ContainerCache) ReconcileContainers(ctx context.Context, dc *docker
 		if c.Labels["org.dcntrlized.hidden"] == "true" {
 			entry.Hidden = true
 		}
+		// Running containers get their manifest fields (capabilities, has_auth,
+		// public_key) fetched best-effort so a Maestro restart surfaces them even
+		// when the container was already up before the watcher subscribed.
+		if c.State == "running" && c.Labels["org.dcntrlized.role"] != "db" {
+			if manifest, err := docker.FetchManifestWithRetry(ctx, c.ID[:12], c.Labels["org.dcntrlized.port"], 20, 50*time.Millisecond); err != nil {
+				log.Printf("Error fetching manifest for container %s: %v", c.ID[:12], err)
+			} else if manifest != nil {
+				entry.Capabilities = manifest.Capabilities
+				entry.HasAuth = manifest.HasAuth
+				entry.PublicKey = manifest.PublicKey
+				updateInstalledMetadataFromManifest(serviceLabel, manifest)
+			}
+		}
 		cache.services[key] = entry
 		cache.Unlock()
 	}