Fix four deployability blockers found by QA (closes #189, closes #190, closes #191, closes #192)

- CSRF over plain HTTP (#189): gorilla/csrf assumed https for its
  same-origin check, so setup and every POST returned 403 over plain
  HTTP. Gate csrf.PlaintextHTTPRequest on a new UPAAS_PLAINTEXT_HTTP
  config value; the default keeps https, correct for a TLS-terminating
  reverse proxy. The README plain-HTTP recipe now sets it.
- git image never pulled (#190): ensureImage pulls alpine/git (pinned
  digest unchanged) when absent, before the clone container is created.
- port-mapping 500 (#192): the ports delete form used {{ .CSRFField }}
  inside {{range .Ports}}, where the dot is a *models.Port; use
  {{ $.CSRFField }} like the labels and volumes blocks.
- env-var 403 (#191): the editor read the CSRF token from $el (the
  submitting form, which has none) instead of $root, sending an empty
  token; read from $root.

Model: opus-4-8

TODO.md

@@ -20,6 +20,10 @@ main cannot regress.
 
 # Completed Steps
 
+- 2026-09-09: Fixed four deployability blockers found by QA: CSRF origin
+  check over plain HTTP (`UPAAS_PLAINTEXT_HTTP`, #189), pulling the git
+  image when absent (#190), the env-var editor CSRF token lookup (#191),
+  and the port-mapping delete form's CSRF field (#192).
 - 2026-08-07: Updated golangci-lint to v2.12.2 (canonical
   `.golangci.yml`, `Dockerfile` lint stage pin, `script/bootstrap`
   release-archive pins) and fixed all resulting lint findings (noctx,