feat: upgrade Backstage v1.28.4 → v1.49.4 with CNOE UI revamp

[punkwalker]

Summary

Full upgrade of the CNOE Backstage developer portal from v1.28.4 to v1.49.4, including a modern UI revamp, new plugin integrations, local testing infrastructure, and developer tooling.

Backstage Core Upgrade

• Backstage CLI 0.26.10 → 0.36.0, backstage.json 1.28.4 → 1.49.4
• Node 22, removed lerna, migrated from @material-ui/v4 to @mui/v5
• Fixed scaffolderActionsExtensionPoint import (moved from /alpha to main export in v1.49.4)

CNOE Vibrant Theme

• Dual light/dark themes with wave SVG hero headers across all pages
• JS-based dark mode detection (responds to Backstage theme toggle, not just OS preference)
• Orange accent buttons with gradient fill, blue ownership tags with shadow
• Consistent header sizing (135px height, centered text) on all routes
• Homepage cards with 3D shadow effect, auto-fill quick links grid

Custom Pages & Components

• CustomApiExplorerPage — hero header + search bar + dropdown filters
• CustomSearchPage — matching layout with filter dropdown (replaces left sidebar)
• HeroHeader shared component for reuse
• Global CSS (main > header) styles stock Backstage pages to match custom ones

Backend

• Auto-detect Kubernetes cluster via service account token (no env var needed in-cluster)
• CNOE custom scaffolder actions: publish:gitea, cnoe:create-argocd-app, cnoe:kubernetes-apply, cnoe:sanitize-resource, cnoe:verify-dependency
• Mock backends for Kubernetes, Terraform, ArgoCD, Proxy (MOCK_MODE=true)
• Conditional plugin loading: GitHub, GitLab, Keycloak OIDC, Roadie ArgoCD

Config-Driven Homepage

• Quick links read from app-config.yaml under homepage.quickLinks
• Supports local paths and external URLs for icons
• Auto-fill grid layout with max-height scroll for 15+ links
• Falls back to hardcoded defaults if config not present

Docker & CI

• Dockerfile: Node 22, NODE_OPTIONS=--no-node-snapshot, copies both app-config.yaml and app-config.production.yaml
• pr.yaml: Node 22, yarn cache, tsc + lint + build:backend
• build-and-push.yaml: scoped to main branch and v* tags only

Local Testing Stack (idpbuilder)

• examples/local-stack/ — add-on package for cnoe-io/stacks ref-implementation
• Kro operator install via Helm + sample WebApp ResourceGraphDefinition
• Backstage RBAC patch for Kro CRD access
• Mock entities wired to fixture data for yarn dev:mock

Developer Tooling

• Taskfile.yml with 27 tasks: task stack:up, task stack:iterate, task dev:mock, task check, etc.
• Playwright e2e tests (8 tests) with guest auth flow
• CLAUDE.md and AGENTS.md for AI agent instructions

Breaking Changes

• Removed lerna.json (no longer a lerna monorepo)
• Removed @internal/plugin-scaffolder-backend-module-gitlab from backend (incompatible extension point)
• Kro backend modules disabled pending extension point compatibility — Kro frontend + CRDs still work via kubernetes-ingestor

Test Plan

• yarn tsc — zero errors
• yarn build:backend — builds successfully
• docker build — image builds with Node 22
• Playwright e2e — 8/8 tests passing
• idpbuilder local stack — verified with ref-implementation + Kro operator
• Scaffolder — publish:gitea action creates repos in Gitea
• Light/dark theme — verified on all pages via Playwright screenshots
• Mock mode — MOCK_MODE=true yarn dev renders all entity tabs