fix: auto-detect hosted_proxy mode when PAPERCLIP_HOSTED_MODE=true (#9)

* feat: use generic model alias for gateway-routed agents

Replaces hardcoded DEFAULT_GATEWAY_MODEL with GATEWAY_MODEL_ALIAS
("default"). The actual upstream model is now controlled server-side
via GATEWAY_DEFAULT_MODEL on the platform gateway — agents never need
to know what model is being served.

New instances get adapterConfig.model = "paperclip-gateway/default".
Existing instances need a one-time DB update.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: update provision-members tests to match current ROLE_PERMISSIONS

PERMISSION_KEYS no longer includes company:delete, and member role
now has [agents:create, tasks:assign, tasks:assign_scope] instead of
[tasks:assign, joins:approve].

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: auto-detect hosted_proxy mode when PAPERCLIP_HOSTED_MODE=true

When PAPERCLIP_HOSTED_MODE=true is set, force deployment mode to
hosted_proxy regardless of what the config file or PAPERCLIP_DEPLOYMENT_MODE
env var says. This eliminates the dead end where a non-managed Docker image
boots in authenticated mode expecting an interactive onboard step.

Also marks authReady=true for hosted_proxy mode since auth is handled by
the platform proxy — the server shouldn't report auth as not ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: WOPR <wopr@localhost>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 3 people

server/src/config.ts

@@ -119,12 +119,16 @@ export function loadConfig(): Config {
       ? process.env.PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE === "true"
       : (fileStorage?.s3?.forcePathStyle ?? false);
 
+  const hostedMode = process.env.PAPERCLIP_HOSTED_MODE === "true";
   const deploymentModeFromEnvRaw = process.env.PAPERCLIP_DEPLOYMENT_MODE;
   const deploymentModeFromEnv =
     deploymentModeFromEnvRaw && DEPLOYMENT_MODES.includes(deploymentModeFromEnvRaw as DeploymentMode)
       ? (deploymentModeFromEnvRaw as DeploymentMode)
       : null;
-  const deploymentMode: DeploymentMode = deploymentModeFromEnv ?? fileConfig?.server.deploymentMode ?? "local_trusted";
+  // Hosted mode forces hosted_proxy — any image works as a managed instance
+  const deploymentMode: DeploymentMode = hostedMode
+    ? "hosted_proxy"
+    : (deploymentModeFromEnv ?? fileConfig?.server.deploymentMode ?? "local_trusted");
   const deploymentExposureFromEnvRaw = process.env.PAPERCLIP_DEPLOYMENT_EXPOSURE;
   const deploymentExposureFromEnv =
     deploymentExposureFromEnvRaw &&
@@ -253,6 +257,6 @@ export function loadConfig(): Config {
     heartbeatSchedulerEnabled: process.env.HEARTBEAT_SCHEDULER_ENABLED !== "false",
     heartbeatSchedulerIntervalMs: Math.max(10000, Number(process.env.HEARTBEAT_SCHEDULER_INTERVAL_MS) || 30000),
     companyDeletionEnabled,
-    hostedMode: process.env.PAPERCLIP_HOSTED_MODE === "true",
+    hostedMode,
   };
 }

server/src/index.ts

@@ -423,7 +423,7 @@ export async function startServer(): Promise<StartedServer> {
     }
   }
 
-  let authReady = config.deploymentMode === "local_trusted";
+  let authReady = config.deploymentMode === "local_trusted" || config.deploymentMode === "hosted_proxy";
   let betterAuthHandler: RequestHandler | undefined;
   let resolveSession:
     | ((req: ExpressRequest) => Promise<BetterAuthSessionResult | null>)