Implement org app deployment layer

[aidankhogg]

Motivation

• Replace the previous hardcoded app image map with a real app catalog and implement a deterministic, auditable org-app deployment flow.
• Use runtime/spec identity outputs for OIDC wiring instead of baked-in Keycloak values and make certificate injection and lifecycle operations deterministic and testable.

Description

• Add a structured catalog abstraction (AppCatalog, AppCatalogEntry, AppOIDCSettings, AppDNSSettings) to represent image, ports, env, volumes, healthcheck path, OIDC and DNS behavior and load spec-provided entries.
• Rework AppHandler.deploy_app to derive deployment behavior from the catalog, persist status transitions (deploying, deployed, failed) and failure details via _persist_deployment, and record issued certificate metadata via _record_certificate.
• Make certificate injection deterministic by creating a host cert directory and passing a read-only bind mount into start_container (via _prepare_cert_mount) before starting the container instead of copying into a running container.
• Add lifecycle helpers on AppHandler: update_app, restart_app, teardown_app, and healthcheck_app, and an improved _start_app_container that composes volumes/env/ports/healthcheck.
• Replace hardcoded Keycloak values in OrgAppsPhaseHandler.execute() by deriving keycloak_url, admin_username, and admin_password from context.runtime_state and spec.identity_inworld, and wire the AppCatalog into the handler.
• Add unit tests in tests/test_app_handler.py covering catalog usage, deterministic cert mounting, DNS and OIDC failure handling, idempotent redeploy, phase identity wiring, and lifecycle helpers.

Testing

• Linting: ran ruff check netengine/handlers/app_handler.py tests/test_app_handler.py and it passed.
• Unit tests: ran pytest -q tests/test_app_handler.py tests/test_m1_handlers.py and all tests passed (new tests in tests/test_app_handler.py plus existing tests/test_m1_handlers.py ran successfully).

---

Codex Task