Fix four deployability blockers found by QA (closes #189, closes #190, closes #191, closes #192)

- CSRF over plain HTTP (#189): gorilla/csrf assumed https for its
  same-origin check, so setup and every POST returned 403 over plain
  HTTP. Gate csrf.PlaintextHTTPRequest on a new UPAAS_PLAINTEXT_HTTP
  config value; the default keeps https, correct for a TLS-terminating
  reverse proxy. The README plain-HTTP recipe now sets it.
- git image never pulled (#190): ensureImage pulls alpine/git (pinned
  digest unchanged) when absent, before the clone container is created.
- port-mapping 500 (#192): the ports delete form used {{ .CSRFField }}
  inside {{range .Ports}}, where the dot is a *models.Port; use
  {{ $.CSRFField }} like the labels and volumes blocks.
- env-var 403 (#191): the editor read the CSRF token from $el (the
  submitting form, which has none) instead of $root, sending an empty
  token; read from $root.

Model: opus-4-8

README.md

@@ -191,6 +191,7 @@ Environment variables:
 | `UPAAS_DATA_DIR` | Data directory for SQLite and keys | `./data` (local dev only — use absolute path for Docker) |
 | `UPAAS_HOST_DATA_DIR` | Host path for DATA_DIR (when running in container) | *(none — must be set to an absolute path)* |
 | `UPAAS_DOCKER_HOST` | Docker socket path | unix:///var/run/docker.sock |
+| `UPAAS_PLAINTEXT_HTTP` | Set when µPaaS is reached over plain HTTP (no TLS-terminating proxy in front) so CSRF origin checks use `http://`. Leave unset behind a TLS-terminating reverse proxy. | false |
 | `DEBUG` | Enable debug logging | false |
 | `SENTRY_DSN` | Sentry error reporting DSN | "" |
 | `METRICS_USERNAME` | Basic auth for /metrics | "" |
@@ -204,9 +205,14 @@ docker run -d \
   -v /var/run/docker.sock:/var/run/docker.sock \
   -v /path/on/host/upaas-data:/var/lib/upaas \
   -e UPAAS_HOST_DATA_DIR=/path/on/host/upaas-data \
+  -e UPAAS_PLAINTEXT_HTTP=true \
   upaas
 ```
 
+This recipe serves plain HTTP, so `UPAAS_PLAINTEXT_HTTP=true` is required for
+setup and every other form to pass the CSRF origin check. Behind a
+TLS-terminating reverse proxy, drop that line.
+
 ### Docker Compose
 
 ```yaml
@@ -221,6 +227,8 @@ services:
       - ${HOST_DATA_DIR}:/var/lib/upaas
     environment:
       - UPAAS_HOST_DATA_DIR=${HOST_DATA_DIR}
+      # Set when serving plain HTTP (no TLS-terminating proxy); drop behind one
+      - UPAAS_PLAINTEXT_HTTP=true
       # Optional: uncomment to enable debug logging
       # - DEBUG=true
       # Optional: Sentry error reporting