Feat/add nodeport traffic exposure

CONTEXT.md

@@ -26,13 +26,18 @@ _Avoid_: SSH key when specifically referring to the provider-side access grant
 The named Git ref selected as the source revision stream for an **App**.
 _Avoid_: branch name when referring to the selected source branch
 
+**App Node Port**:
+A direct node-level exposure that maps a cluster node port to one container port and protocol on an 
+
 ## Relationships
 
 - An **App** has exactly one **Source**.
+- An **App** can have zero or more **App Node Ports**.
 - A **Git HTTPS Source** belongs to exactly one **App**.
 - A **Git SSH Source** belongs to exactly one **App**.
 - A **Git Source** has exactly one selected **Git Branch** before it can be saved.
 - A **Git SSH Source** requires a **Deploy Key** before QuickStack offers **Git Branch** selection.
+- An **App Node Port** belongs to exactly one **App** and exposes exactly one container port/protocol.
 
 ## Example Dialogue
 
@@ -42,7 +47,11 @@ _Avoid_: branch name when referring to the selected source branch
 > **Dev:** "Can QuickStack list branches for a **Git SSH Source** before the provider knows its **Deploy Key**?"
 > **Domain expert:** "No, the user must generate the key and register it as a **Deploy Key** with the Git provider before branch selection is shown."
 
+> **Dev:** "If an **App** uses an **App Node Port**, should a restrictive ingress policy still block that node-level traffic?"
+> **Domain expert:** "No — creating the **App Node Port** is the explicit decision to expose that one container port/protocol through the cluster node."
+
 ## Flagged Ambiguities
 
 - "connect to a git https" means configuring a **Git HTTPS Source** for an **App**.
 - "branch" means the selected **Git Branch**, not a build branch or deployment branch.
+- "node portforwarding" means an **App Node Port**, not an ad hoc developer port-forward session.

prisma/migrations/20260406153931_migration/migration.sql

@@ -0,0 +1,14 @@
+-- CreateTable
+CREATE TABLE "AppNodePort" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "appId" TEXT NOT NULL,
+    "port" INTEGER NOT NULL,
+    "nodePort" INTEGER NOT NULL,
+    "protocol" TEXT NOT NULL DEFAULT 'TCP',
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "AppNodePort_appId_fkey" FOREIGN KEY ("appId") REFERENCES "App" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AppNodePort_nodePort_key" ON "AppNodePort"("nodePort");

prisma/schema.prisma

@@ -224,6 +224,7 @@ model App {
 
   appDomains         AppDomain[]
   appPorts           AppPort[]
+  appNodePorts       AppNodePort[]
   appVolumes         AppVolume[]
   appFileMounts      AppFileMount[]
   appBasicAuths      AppBasicAuth[]
@@ -257,6 +258,20 @@ model AppPort {
   @@unique([appId, port])
 }
 
+model AppNodePort {
+  id       String @id @default(uuid())
+  appId    String
+  app      App    @relation(fields: [appId], references: [id], onDelete: Cascade)
+  port     Int
+  nodePort Int
+  protocol String @default("TCP")
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@unique([nodePort])
+}
+
 model AppDomain {
   id            String  @id @default(uuid())
   hostname      String  @unique

src/__tests__/git-test-repositories.utils.ts

@@ -44,8 +44,9 @@ export function createGitApp(input: Pick<AppExtendedModel, 'id' | 'sourceType' |
         },
         appDomains: [],
         appPorts: [],
+        appNodePorts: [],
         appFileMounts: [],
         appVolumes: [],
         appBasicAuths: [],
     } as AppExtendedModel;
-}
+}

src/__tests__/integration/server/services/build.service.integration.spec.ts

@@ -256,6 +256,7 @@ function createBuildApp(input: BuildIntegrationInput & { id: string; projectId:
         },
         appDomains: [],
         appPorts: [],
+        appNodePorts: [],
         appFileMounts: [],
         appVolumes: [],
         appBasicAuths: [],