feat(vpn): intégration Tailscale/Headscale + URLs publiques par sous-domaine

- Ajout d'un conteneur Tailscale côté serveur pour joindre les agents via IPs Tailscale
- Configuration Headscale exposé en HTTPS via Caddy (headscale.alfrednobel.edudeploy.com)
- Caddy configuré pour les sous-domaines avec TLS on-demand
- Middleware et route proxy Next.js pour router les sous-domaines vers les agents
- Ajout du champ domain sur Establishment et affichage de l'URL publique dans le dashboard
- Agent Windows v0.2.3 avec proxy Tailscale par instance pour contourner Docker Desktop
- Templates WordPress/PrestaShop bindés sur 0.0.0.0 pour être accessibles via Tailscale

server/app/api/instances/route.ts

@@ -18,10 +18,37 @@ export async function GET(req: NextRequest) {
 
   const instances = await prisma.instance.findMany({
     where,
-    include: { node: { include: { student: { include: { class: true } } } }, template: true },
+    include: {
+      node: {
+        include: {
+          student: {
+            include: {
+              class: {
+                include: {
+                  establishment: true,
+                },
+              },
+            },
+          },
+        },
+      },
+      template: true,
+    },
     orderBy: { createdAt: "desc" },
   });
-  return NextResponse.json(instances);
+
+  const enriched = instances.map((inst) => {
+    const domain = inst.node.student?.class.establishment?.domain;
+    const publicUrl = domain
+      ? `https://${inst.id}.${domain}`
+      : null;
+    return {
+      ...inst,
+      publicUrl,
+    };
+  });
+
+  return NextResponse.json(enriched);
 }
 
 export async function POST(req: NextRequest) {
@@ -35,12 +62,24 @@ export async function POST(req: NextRequest) {
     data: { nodeId, templateId, port: port || 8080, status: "stopped" },
   });
 
+  const node = await prisma.node.findUnique({
+    where: { id: nodeId },
+    include: { student: { include: { class: { include: { establishment: true } } } } },
+  });
+
+  const domain = node?.student?.class.establishment?.domain;
+  const publicUrl = domain ? `https://${instance.id}.${domain}` : null;
+
   const sent = sendToNode(nodeId, {
     action: "start",
     instanceId: instance.id,
     type: template.type,
     port: instance.port,
-    composeConfig: template.composeConfig.replace(/{PORT}/g, String(instance.port)).replace(/{INSTANCE_ID}/g, instance.id),
+    composeConfig: template.composeConfig
+      .replace(/{PORT}/g, String(instance.port))
+      .replace(/{INSTANCE_ID}/g, instance.id)
+      .replace(/{PUBLIC_URL}/g, publicUrl || `http://localhost:${instance.port}`)
+      .replace(/{PUBLIC_DOMAIN}/g, domain || "localhost"),
   });
 
   if (!sent) {
@@ -53,9 +92,12 @@ export async function POST(req: NextRequest) {
 export async function PATCH(req: NextRequest) {
   const body = await req.json();
   const { id, action } = body;
-  const instance = await prisma.instance.findUnique({ where: { id }, include: { template: true } });
+  const instance = await prisma.instance.findUnique({ where: { id }, include: { template: true, node: { include: { student: { include: { class: { include: { establishment: true } } } } } } } });
   if (!instance) return NextResponse.json({ error: "Not found" }, { status: 404 });
 
+  const domain = instance.node.student?.class.establishment?.domain;
+  const publicUrl = domain ? `https://${instance.id}.${domain}` : null;
+
   if (action === "stop") {
     sendToNode(instance.nodeId, { action: "stop", instanceId: instance.id });
     await prisma.instance.update({ where: { id }, data: { status: "stopped" } });
@@ -65,7 +107,11 @@ export async function PATCH(req: NextRequest) {
       instanceId: instance.id,
       type: instance.template.type,
       port: instance.port,
-      composeConfig: instance.template.composeConfig.replace(/{PORT}/g, String(instance.port)).replace(/{INSTANCE_ID}/g, instance.id),
+      composeConfig: instance.template.composeConfig
+        .replace(/{PORT}/g, String(instance.port))
+        .replace(/{INSTANCE_ID}/g, instance.id)
+        .replace(/{PUBLIC_URL}/g, publicUrl || `http://localhost:${instance.port}`)
+        .replace(/{PUBLIC_DOMAIN}/g, domain || "localhost"),
     });
     if (!sent) await prisma.instance.update({ where: { id }, data: { status: "error" } });
   } else if (action === "reset") {