fix(docker): correct VS Code port mapping from 60001 to 8001 (#62)

## Summary

- Fix VS Code runtime subdomain 502 error caused by incorrect port
mapping in Patch 32
- The agent-server SDK defaults VS Code to port **8001**, but
`patch-exposed-urls.py` mapped it to **60001** (a port where nothing
listens)
- This caused `can_connect(ip, 60001)` in OpenResty to fail → 502
"Upstream not reachable"

### Root Cause

`docker/patch-exposed-urls.py` Patch 32 had `_port_map = {'vscode':
60001, ...}` but the upstream `software-agent-sdk` config defaults
`vscode_port=8001` and starts VS Code with `--host 0.0.0.0 --port
{vscode_port}`.

### Verification (staging)

| Port | Status | Service |
|------|--------|---------|
| 8000 | 200 ✅ | agent-server |
| 8001 | 302/403 ✅ | VS Code server (needs token) |
| 60001 | 000 ❌ | Nothing listening |

## Test plan

- [x] Build passes (`npm run build`)
- [x] Unit tests pass (`npm run test`) — 129 TS + 100 Python
- [x] CI checks pass
- [x] Reviewer bot findings addressed (no new findings)
- [x] Deployed to staging
- [x] **E2E tests pass**
  - [x] TC-003: Login
  - [x] TC-004: Conversation List
  - [x] TC-005: New Conversation
- [x] TC-010: VS Code port mapping verified (8001→302, 60001→502 via
curl; runtime routing confirmed in browser)

## Checklist

- [x] E2E test cases updated (port references corrected)
- [x] CDK snapshot updated (Docker image hash changed)

Author: zxkane

docker/patch-exposed-urls.py

@@ -7,7 +7,7 @@
 
 The VSCODE exposed URL should use the agent-server's /api/vscode/url
 endpoint to get the real VS Code URL, since VS Code runs on a different
-port (60001) than the agent-server (8000).
+port (8001, the agent-server SDK default) than the agent-server (8000).
 """
 import sys
 
@@ -36,7 +36,7 @@
     # https://{port}-{convId}.runtime.{subdomain}.{domain}/
     # Using localhost instead of VPC IP ensures the URL goes through
     # the frontend rewriter → CloudFront → ALB → OpenResty → sandbox
-    _port_map = {'vscode': 60001, 'work-1': 12000, 'work-2': 12001}
+    _port_map = {'vscode': 8001, 'work-1': 12000, 'work-2': 12001}
     port = _port_map.get(service_name)
     if port:
         return f'http://localhost:{port}'
@@ -46,14 +46,8 @@
 
 if OLD in content:
     content = content.replace(OLD, NEW)
-    # Also fix VS Code folder path to /workspace (not /workspace/project)
-    # for consistency with Changes panel which shows /workspace/ level git changes
-    content = content.replace(
-        "folder=%2Fworkspace%2Fproject",
-        "folder=%2Fworkspace"
-    )
     with open(SERVICE_FILE, "w") as f:
         f.write(content)
-    print("Patch 32: Fixed _build_service_url + VS Code folder path for Fargate")
+    print("Patch 32: Fixed _build_service_url for Fargate")
 else:
     print("WARNING: Patch 32 pattern not found in remote_sandbox_service.py")

test/E2E_TEST_CASES.md

@@ -408,7 +408,7 @@ mcp__chrome-devtools__evaluate_script({
     };
   }`
 })
-// Expected: { status: 200, url: "http://localhost:60001/?tkn=...", isLocalhost: true }
+// Expected: { status: 200, url: "http://localhost:8001/?tkn=...", isLocalhost: true }
 // If url contains VPC IP (172.31.x.x) → Patch 32 not applied
 // If url contains "vscode-" prefix → Patch 32 not applied
 
@@ -421,7 +421,7 @@ mcp__chrome-devtools__evaluate_script({
     const parts = host.split('.');
     const subdomain = parts[0];
     const domain = parts.slice(1).join('.');
-    const runtimeUrl = 'https://60001-' + convId + '.runtime.' + subdomain + '.' + domain + '/';
+    const runtimeUrl = 'https://8001-' + convId + '.runtime.' + subdomain + '.' + domain + '/';
     return runtimeUrl;
   }`
 })
@@ -897,8 +897,8 @@ Verify that VS Code editor URLs (main domain with port) are correctly rewritten
 
 5. Look for VS Code URL patterns in agent output or browser behavior
    ```
-   Original: http://<subdomain>.<domain>:49955/?tkn=xxx&folder=/workspace
-   Rewritten: https://49955-<convId>.runtime.<subdomain>.<domain>/?tkn=xxx&folder=/workspace
+   Original: http://<subdomain>.<domain>:49955/?tkn=xxx&folder=/workspace/project
+   Rewritten: https://49955-<convId>.runtime.<subdomain>.<domain>/?tkn=xxx&folder=/workspace/project
    ```
 
 6. Verify the rewritten URL works

test/__snapshots__/stacks.test.ts.snap

@@ -1507,7 +1507,7 @@ security_analyzer = "llm"",
               "Timeout": 10,
             },
             "Image": {
-              "Fn::Sub": "123456789012.dkr.ecr.us-west-2.\${AWS::URLSuffix}/cdk-hnb659fds-container-assets-123456789012-us-west-2:2f643b868e1855ffb33bfa80a5648d8120f168eabaad7f28579df1d8241fd154",
+              "Fn::Sub": "123456789012.dkr.ecr.us-west-2.\${AWS::URLSuffix}/cdk-hnb659fds-container-assets-123456789012-us-west-2:ee46f00a1dbd4a279611aea0978d01d2261603681673d2e968c34a9d647ebe99",
             },
             "LogConfiguration": {
               "LogDriver": "awslogs",