Replace custom code-server (9GB) with upstream LinuxServer image (~1GB)

Drop the custom Dockerfile.code-server that bundled Claude Code CLI,
Python/MkDocs tooling, and build-essential on top of codercom base.
Switch to the already-mirrored linuxserver/code-server image instead.

- Both compose files: use code-server:latest, LinuxServer env vars
  (PUID/PGID/DEFAULT_WORKSPACE), port 8443, /config mount layout
- Nginx configs + templates: proxy to :8443 instead of :8080
- API env default: CODE_SERVER_URL updated to :8443
- build-and-push.sh: remove --include-code-server flag
- upgrade.sh: remove code-server conditional rebuild + registry fallback
- install.sh: add --ignore-pull-failures for optional missing images
- .env.example, CCP templates, bunker-ops template: updated

Bunker Admin

scripts/build-and-push.sh

@@ -10,7 +10,6 @@
 # Options:
 #   --services a,b,c      Comma-separated list of services to build
 #                         (default: api admin media-api nginx)
-#   --include-code-server Also build and push code-server (~9GB, slow)
 #   --no-push             Build only, skip push (verify builds work)
 #   --tag TAG             Override commit SHA tag (default: git rev-parse --short HEAD)
 #   --registry URL        Override registry (default: gitea.bnkops.com/admin)
@@ -30,7 +29,6 @@ REGISTRY="${GITEA_REGISTRY:-gitea.bnkops.com/admin}"
 COMMIT_SHA="$(git -C "$PROJECT_DIR" rev-parse --short HEAD 2>/dev/null || echo "local")"
 TAG="${COMMIT_SHA}"
 SERVICES="api admin media-api nginx"
-INCLUDE_CODE_SERVER=false
 NO_PUSH=false
 DRY_RUN=false
 
@@ -52,7 +50,6 @@ run()     { if [[ "$DRY_RUN" == "true" ]]; then echo -e "${CYAN}[DRY-RUN]${NC} $
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --services)          SERVICES="${2//,/ }"; shift 2 ;;
-    --include-code-server) INCLUDE_CODE_SERVER=true; shift ;;
     --no-push)           NO_PUSH=true; shift ;;
     --tag)               TAG="$2"; shift 2 ;;
     --registry)          REGISTRY="$2"; shift 2 ;;
@@ -64,11 +61,6 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
-# Add code-server if requested
-if [[ "$INCLUDE_CODE_SERVER" == "true" ]]; then
-  SERVICES="$SERVICES code-server"
-fi
-
 echo -e "${BOLD}Changemaker Lite — Build & Push${NC}"
 echo "  Registry:  $REGISTRY"
 echo "  Tag:       $TAG"
@@ -119,15 +111,6 @@ build_service() {
         --load \
         "${PROJECT_DIR}/nginx"
       ;;
-    code-server)
-      warn "Building code-server (~9GB) — this will take a while..."
-      run docker buildx build \
-        --file "${PROJECT_DIR}/Dockerfile.code-server" \
-        --tag "${image}" \
-        --tag "${image_latest}" \
-        --load \
-        "${PROJECT_DIR}"
-      ;;
     *)
       error "Unknown service: $svc"
       return 1

scripts/install.sh

@@ -256,7 +256,9 @@ if [[ "$START_SERVICES" =~ ^[Yy]$ ]]; then
   echo ""
   cd "$INSTALL_DIR"
 
-  if ! docker compose pull 2>&1; then
+  # --ignore-pull-failures: optional services may not have images in the
+  # registry yet — don't abort the whole install for those.
+  if ! docker compose pull --ignore-pull-failures 2>&1; then
     echo ""
     error "Failed to pull images from the registry."
     echo ""

scripts/upgrade.sh

@@ -21,7 +21,7 @@ MIN_DISK_MB=2048
 # Source-built containers (always rebuilt)
 SOURCE_CONTAINERS="api admin media-api"
 # Conditionally rebuilt if Dockerfile changed
-CONDITIONAL_CONTAINERS="nginx code-server"
+CONDITIONAL_CONTAINERS="nginx"
 # App containers stopped during upgrade
 APP_CONTAINERS="api admin media-api nginx"
 # Infrastructure containers (must stay up)
@@ -884,24 +884,6 @@ if [[ "$USE_REGISTRY" == "true" ]]; then
     fi
   fi
 
-  # code-server: pull from registry if available; never build during upgrade
-  # (code-server is 9GB+ and takes 30+ min to build — run build-and-push.sh separately)
-  CS_IMAGE="${REGISTRY}/changemaker-code-server"
-  if docker image inspect "${CS_IMAGE}:${REGISTRY_TAG}" &>/dev/null 2>&1; then
-    info "code-server:${REGISTRY_TAG} already present, skipping"
-  elif docker compose pull code-server 2>/dev/null; then
-    success "code-server pulled from registry"
-  else
-    # Try :latest, then retag any existing local image so compose up doesn't build
-    for fallback_tag in latest local; do
-      if docker image inspect "${CS_IMAGE}:${fallback_tag}" &>/dev/null 2>&1; then
-        docker tag "${CS_IMAGE}:${fallback_tag}" "${CS_IMAGE}:${REGISTRY_TAG}" 2>/dev/null || true
-        info "Tagged code-server:${fallback_tag} → :${REGISTRY_TAG}"
-        break
-      fi
-    done
-  fi
-
 else
   # --- Source build path (original behaviour) ---
   info "Rebuilding source containers: $SOURCE_CONTAINERS"
@@ -920,15 +902,6 @@ else
           info "nginx unchanged, skipping rebuild"
         fi
         ;;
-      code-server)
-        if echo "$CHANGED_FILES" | grep -q "^Dockerfile.code-server"; then
-          info "Rebuilding code-server (Dockerfile changed)..."
-          docker compose build code-server
-          success "code-server rebuilt"
-        else
-          info "code-server unchanged, skipping rebuild"
-        fi
-        ;;
     esac
   done
 fi