Portal server mode for Dokploy: Dockerfile, PORTAL_URLS, PORTAL_SERVER

The results Portal in a Linux container (python 3.13-slim + ODBC Driver
18). PORTAL_SERVER=1: no Start / Stop (the bot runs on the Windows PC).
PORTAL_URLS: allowed hosts / origins, Secure cookie when all https.
RESULTS_DB_CONN (a SQL login) goes in Dokploy's environment, never here.
71 test files, 1222 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_portal_signin.py

@@ -332,6 +332,52 @@ def the_sign_in_page_says_what_the_portal_is_and_helps_with_the_password():
     assert '<link rel="icon"' in page, "a tab icon, no /favicon.ico 404"
 
 
+@case
+def a_server_portal_never_starts_the_bot():
+    """Dokploy, 2026-10-27: the bot runs only on the Windows PC, so the
+    Portal on the server shows results and never offers Start / Stop."""
+    store = FakeUserStore()
+    portal_users.Accounts(store).create_user("sam", "Sam", "Super Admin", PW)
+    app = web_app.create_app(FakeRepo(), users_store=store, can_start=False,
+                             logs_dir=tempfile.mkdtemp())
+    c, _ = _sign_in(app, "sam")
+    assert "const CAN_RUN = false;" in c.get("/").text
+    h = {**ORIGIN, "X-Run-Token": app.state.run_token}
+    assert c.post("/api/bot/start", headers=h).status_code == 403
+    assert c.post("/api/bot/stop", headers=h).status_code == 403
+    st = c.get("/api/bot/status").json()
+    assert st["running"] is False, st
+    assert c.get("/runs").status_code == 200
+
+
+@case
+def the_portal_url_gives_the_hosts_origins_and_a_secure_cookie():
+    env = web_app.portal_settings("https://cv.example.com, "
+                                  "http://10.0.0.5:8080/", server=True)
+    assert env == {"allowed_hosts": ["cv.example.com", "10.0.0.5"],
+                   "allowed_origins": ["https://cv.example.com",
+                                       "http://10.0.0.5:8080"],
+                   "secure_cookie": False, "can_start": False}, env
+    assert web_app.portal_settings("https://cv.example.com",
+                                   server=True)["secure_cookie"] is True
+    local = web_app.portal_settings("", server=False)
+    assert local == {"allowed_hosts": list(web_app.ALLOWED_HOSTS),
+                     "allowed_origins": list(web_app.ALLOWED_ORIGINS),
+                     "secure_cookie": False, "can_start": True}, local
+    base = "https://cv.example.com"
+    store = FakeUserStore()
+    portal_users.Accounts(store).create_user("sam", "Sam", "Viewer", PW)
+    app = web_app.create_app(FakeRepo(), runner=FakeRunner(),
+                             users_store=store, logs_dir=tempfile.mkdtemp(),
+                             **web_app.portal_settings(base, server=True))
+    r = TestClient(app, base_url=base).post(
+        "/signin", headers={"Origin": base}, follow_redirects=False,
+        data={"username": "sam", "password": PW,
+              "token": app.state.run_token, "next": "/"})
+    assert r.status_code == 303, r.status_code
+    assert "; secure" in r.headers["set-cookie"].lower(), r.headers
+
+
 @case
 def no_signed_in_page_carries_an_inline_style():
     app, _, _ = _portal()