Feat default surface routing + fix startup hang (#4)

Default surface routing (v0.2.1):
- `/` redirects to configurable default surface with fallback chain:
  configured → first enabled extension surface → /admin
- Auto-sets default_surface on first extension surface install
- Admin settings UI: Default Surface dropdown
- disabledRedirect() and extension surface disabled redirect now go to
  /admin instead of / to prevent redirect loops

Fix Gin route param conflict causing backend startup hang:
- Team package settings routes used `:pkgId` while sibling routes used
  `:id` — Gin's radix tree entered infinite loop on conflicting param
  names. Unified to `:id`.

Docker entrypoint hardening:
- Health check timeout 10s → 60s
- Stale backend process cleanup on restart
- Crash detection (exit early if backend dies)

Roadmap direction updates:
- v0.3.0: Notes surface (Obsidian-style) replaces Editor surface
- v0.4.0: MVP (was v0.5.0) — chat moved to post-MVP
- No built-in auto-install — explicit install only

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ROADMAP.md

@@ -48,7 +48,7 @@ SDK stabilization, and the first rebuilt extension (tasks).
 
 | Step | Status | Description |
 |------|--------|-------------|
-| Default surface routing | 🔲 | `/` redirects to configurable default surface. No surfaces → admin. First install becomes default. Changeable in admin settings. |
+| Default surface routing | ✅ | `/` redirects to configurable default surface. No surfaces → admin. First install becomes default. Changeable in admin settings. |
 | ICD (API contract) | 🔲 | OpenAPI spec from registered routes, kernel-only endpoint docs |
 
 ### v0.2.2 — Event Bus + Triggers
@@ -65,42 +65,35 @@ SDK stabilization, and the first rebuilt extension (tasks).
 | SDK stabilization | 🔲 | `sb.slots()`, `sb.actions`, `sb.api.ext()`, `sb.storage`, theme tokens, primitive UI |
 | Task extension | 🔲 | First proof-of-concept — full task system rebuilt as Starlark extension using triggers + ext_data + notifications |
 
-## v0.3.0 — Editor Surface
+## v0.3.0 — Notes Surface
 
-The code/markdown editor rebuilt as an installable surface package.
+Obsidian-style rich-text notes rebuilt as an installable surface package.
 Zero platform special-casing. Proves the full extension stack E2E.
 
-- Editor as `.pkg` archive
-- CM6 integration via surface viewport
-- File tree, tabs, preview pane — all extension-provided
+- Notes as `.pkg` archive
+- Rich text editor (ProseMirror or similar)
+- Folder tree, backlinks, tags — all extension-provided
+- Markdown import/export
 
-## v0.4.0 — Chat Extension
-
-The AI chat system rebuilt as an installable extension package.
-
-- Provider registry as extension (BYOK chain, model catalog)
-- Completion streaming via Starlark `provider.complete`
-- Personas as extension data
-- Channel/message storage via ext_data tables
-- Tool system as extension hooks
-
-## v0.5.0 — MVP
+## v0.4.0 — MVP
 
 Extension and operations tracks converge. First externally usable release.
 
 - Package registry (browse, install, update, uninstall)
-- Extension marketplace foundations
+- Package distribution model (no auto-install; explicit install only)
 - Health monitoring dashboard
 - Backup/restore tooling
 - Documentation site
 
 ## Post-MVP
 
+- Chat extension (provider registry, streaming, personas, tool system)
 - Rich media extensions: image generation, code sandbox, STT/TTS
 - Desktop app (Tauri or Electron)
 - Sidecar tier: container-based extensions
 - Federation: cross-instance package sharing
 - Plugin marketplace with signing and review
+- Mermaid diagrams extension (nice-to-have)
 
 ## Design Decisions Log
 
@@ -116,3 +109,6 @@ Extension and operations tracks converge. First externally usable release.
 | Admin → RBAC group | The `role` column is pre-RBAC. v0.2.0 replaces it with a seeded "Admins" group + `surface.admin.access` grant. All users auto-join "Everyone" group. Admin middleware becomes a grant check, not a role check. |
 | Settings cascade | RBAC controls scope auth (who can set at what level). `user_overridable` flag controls whether lower scopes can override higher. Two orthogonal axes, composes cleanly with extension manifests. |
 | No new migrations pre-MVP | Edit existing migration SQL files in place. No migration chains until schema is in production. |
+| Notes over Editor | First surface is Obsidian-style notes (rich text, folders, backlinks) instead of a code editor. Notes is a stronger E2E proof — it exercises ext_data, storage, and the SDK more fully than a pure-browser CM6 editor. |
+| No built-in auto-install | Extensions ship in the repo but are not auto-installed. Distribution model TBD — explicit install only. Keeps the kernel clean and avoids opinionated defaults. |
+| Chat → post-MVP | Chat extension (providers, streaming, personas) is valuable but not MVP-critical. The platform must prove itself with simpler surfaces first. Chat moves to post-MVP track. |