[vazra]

Found by the E2E audit.

• Multi-endpoint app templates failed in Quick test mode (mailpit, minio, docker-registry): every domain variable got the same sslip.io name, and the server refuses two endpoints with the same domain and path. The main domain keeps <slug>.<ip>.sslip.io; other domain variables get their own name (e.g. minio-console). The picker shows each auto domain.
• 25 of 29 service templates could not deploy: adding a service copied its config but never declared the named volumes it uses, so the wizard said "Valid compose file" and docker compose up failed. Named volumes are now declared; a second copy gets its own volume (pgdata2) instead of sharing data.
• gitea service template mounted /etc/timezone and /etc/localtime, which compose security checks refuse. Removed.
• Delete App dialog said it deletes "all its data", but data volumes are kept (compose down without -v). The text now says what is removed, that volumes stay, and where to remove them (Docker page). Docs updated (archived-apps, CLI remove, apps-and-services).

Tests: per-template quick-test endpoint uniqueness (failed on exactly those 3), per-service-template volume declarations, click-through VisualEditor tests, delete dialog regression. Full vitest (590) passes.

Follow-up (not changed here): the mailpit template exposes SMTP (port 1025) as an HTTP endpoint through the proxy, which deploys now but likely cannot carry SMTP; it needs a template redesign.

[vazra]

Template matrix shard 4 failed on Woodpecker CI: its agent mounts /var/run/docker.sock, which deploy refuses for every app since the compose security checks (host root). Before this branch the matrix accepted a failed deploy for templates with no HTTP probe, so the template looked fine. Removed the template in f3f32a1.