fix: stabilize SuperAPI direct route

[01-Yang]

What changed

• map the stable container name superapi-direct to Docker host-gateway
• add a repository contract that rejects pinned numeric Docker bridge addresses
• validate the mapping in Zero One CI
• document the production canary, rollback, and post-change acceptance thresholds

Why

Production usage isolation showed that the public SuperAPI path had materially worse TTFT and provider 5xx than the existing host-local direct tunnel. The initial live canary used 172.18.0.1:18181, but a Docker bridge address can change whenever the Compose network is recreated. This change makes the direct route durable without changing application images or credentials.

Validation

• sh -n deploy/zero-one/test-direct-upstream.sh
• sh deploy/zero-one/test-direct-upstream.sh
• sh deploy/zero-one/test-routing.sh
• YAML parse of Compose and workflow files
• git diff --check

Production deployment remains a separate operator step: update the host Compose file, validate the rendered mapping, force-recreate only sub2api, verify the tunnel from the container, and then replace the temporary numeric Base URL with http://superapi-direct:18181.

[01-Yang]

CI baseline note: the required backend-security and frontend-security failures are unrelated to this Compose/docs change. The current stable baseline now fails on Go 1.26.5 standard-library advisories fixed by upstream #5639, and nanoid@3.3.17 fixed by upstream #5638. No audit exception or branch-protection bypass is proposed. Keep this PR draft until those fixes land in a stable upstream tag and the Zero One baseline is synced separately.

[01-Yang]

Production canary update (2026-08-14 CST):

• Applied the host-gateway mapping and force-recreated only sub2api; the container is healthy and has no host port binding.
• Resolved superapi-direct from inside the running container, bound the bridge only to that resolved host address, and restricted UFW ingress to the current Compose gateway subnet. Port 18181 remains unreachable publicly.
• Provider Accounts fix: stabilize landing logo fallback #2 and chore(release): sync Sub2API v0.1.176 with pricing hotfixes #6 now use http://superapi-direct:18181 with no account proxy. Both passed a GPT-5.5 connectivity request after the final listener/firewall state.
• Post-cutover real-user sample count for chore(release): sync Sub2API v0.1.176 with pricing hotfixes #6 is still zero. Keep the remaining public-route accounts unchanged until at least 50 comparable gpt-5.5/high/native Responses samples meet TTFT P50 <= 12s, P90 <= 25s, and provider 5xx <= 2%.