[pending-judge] feat(selector): App Selector deploys via shipdeck catalog (DC-CATALOG-3)

Submit rewired from /api/v1/apps/deploy (Docker chain) to
/api/v1/deploys/catalog/deploy (shipdeck bridge -> OCI systemd service).
Same modal, same fields: port, mediaPath, plex claim token (sent as env).
No new UI screens. Docker chain no longer called from the selector.

status/js/app-selector.js

@@ -777,11 +777,20 @@
         }
       }
 
-      // Call deployment API
-      const response = await secureFetch('/api/v1/apps/deploy', {
+      // DC-CATALOG-3: deploy through shipdeck (no Docker daemon). The
+      // bridge renders the catalog entry server-side and runs the OCI
+      // image as a hardened systemd service. Same modal, same fields.
+      const catalogPayload = {
+        app: appTemplate.id,
+        port: deployConfig.port || appTemplate.defaultPort || null,
+        media_path: deployConfig.mediaPath || '',
+        env: deployConfig.plexClaimToken ? { PLEX_CLAIM: deployConfig.plexClaimToken } : {}
+      };
+
+      const response = await secureFetch('/api/v1/deploys/catalog/deploy', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(apiDeployConfig)
+        body: JSON.stringify(catalogPayload)
       });
 
       const result = await response.json();
@@ -792,8 +801,8 @@
           id: deployConfig.subdomain,  // Use subdomain as ID
           name: appTemplate.name,
           logo: `/assets/${appTemplate.id}.png`,
-          containerId: result.containerId,
-          url: result.url,
+          containerId: null,  // shipdeck deploys have no docker container id
+          url: result.url || `http://127.0.0.1:${catalogPayload.port}`,
           ip: deployConfig.ip,  // Store IP for DNS record deletion
           appTemplate: appTemplate.id,  // Store original template ID
           tailscaleOnly: deployConfig.tailscaleOnly || false  // Tailscale protection status