[Fix] GitLab OAuth, Gitea bot loops, Docker cleanup, and PR funnel scoping

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

Related issue

Follow-up for review findings on #351 (release promote). Fixes are opening against develop rather than the frozen release branch.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

What changed

Fixes the seven open review findings from the v1.0.0 promote PR (#351), landed on develop so they can ship independently of the release branch:

• GitLab PR listing uses the OAuth-aware token header, so OAuth-backed GitLab connections can list and sync merge requests.
• Gitea mention intake ignores the deployment-token identity even when its username lacks a roomote prefix.
• Failed nested-Docker standby resumes stop the privileged project Docker daemon (without removing the retained container), so it is not left running and later resumes can still docker start it.
• GitLab OAuth authorization and callback use the public app URL when set, so installs with an internal or loopback R_APP_URL still redirect users to a reachable callback.
• Source-control settings no longer wipe unsaved field edits when provider status refetches.
• Product PR-funnel cohort keys and merge-duration fact matching include source-control host (and provider on the name fallback) so same-named repos across hosts/providers do not collapse or cross-match.

How it was tested

• pnpm --filter @roomote/api Gitea handleComment tests (including non-roomote-prefix deployment identity)
• pnpm --filter @roomote/db instance-report pure + isolation tests
• pnpm --filter @roomote/sdk source-control pull-request reads tests, including OAuth Bearer listing
• Package tsc --noEmit / pre-push typecheck for controller and related packages

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

[roomote-roomote]

No code issues found. See task

• apps/controller/src/compute-providers/spawn-docker-worker.ts:441 Removing the nested Docker daemon after a failed standby resume permanently breaks later resumes for Docker-project environments. The daemon is created only on a fresh spawn, while later resumes only issue a failure-tolerant docker start; the retained worker then starts with DOCKER_HOST pointing at a daemon that no longer exists. Preserve the daemon or recreate it before each resume.

_{Reviewed ea365ab}

[roomote-roomote]

Fixed the standby-resume daemon cleanup stack from the Roomote review summary.

Change: on a failed standby resume for nested-Docker project tasks, stop the retained <worker>-docker daemon instead of removing it. That keeps the privileged daemon from staying up after failure while still allowing later resumes (which only docker start the retained daemon).

Pushed in ea365ab on fix/pr-351-review-issues / #352.