fix: port changes now propagate to containers via env file in-place writes

Root cause: write_env_file used os.replace() which creates a new inode.
Docker file bind-mounts track the original inode at mount time, so the
container's /app/.env.compose never saw updates — docker compose always
read the stale port value and skipped container recreation.

Fixes:
- ip_utils.write_env_file: write in-place (open 'w') instead of os.replace()
  so Docker bind-mounted files see the update immediately
- apply_pending_config: add --force-recreate to docker compose up for
  specific-container restarts, bypassing config-hash comparison as a
  belt-and-suspenders measure

Tests added:
- TestWriteEnvFileInPlace: verifies inode is preserved across writes
- TestApplyPendingConfigForceRecreate: verifies --force-recreate is in the
  docker compose command for specific-container restarts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -1024,7 +1024,7 @@ def apply_pending_config():
                      '--project-directory', project_dir,
                      '-f', '/app/docker-compose.yml',
                      '--env-file', '/app/.env.compose',
-                     'up', '-d', '--no-deps'] + containers,
+                     'up', '-d', '--no-deps', '--force-recreate'] + containers,
                     capture_output=True, text=True, timeout=120,
                 )
                 if result.returncode != 0:

api/ip_utils.py

@@ -233,12 +233,13 @@ def write_env_file(ip_range: str, path: str, ports: Optional[Dict[str, int]] = N
         for key, var in PORT_ENV_VAR_NAMES.items():
             lines.append(f'{var}={merged_ports[key]}\n')
         os.makedirs(os.path.dirname(os.path.abspath(path)), exist_ok=True)
-        tmp = path + '.tmp'
-        with open(tmp, 'w') as f:
-            f.writelines(lines)
+        content = ''.join(lines)
+        # Write in-place (same inode) so Docker bind-mounted files see the update.
+        # os.replace() changes the inode which breaks file bind-mounts inside containers.
+        with open(path, 'w') as f:
+            f.write(content)
             f.flush()
             os.fsync(f.fileno())
-        os.replace(tmp, path)
         return True
     except Exception:
         return False