Check a custom-deploy manifest before deploying it

Returns two kinds of finding.

errors are the exact reasons the create endpoint would reject the manifest — checked by calling the same validator, not a copy, so valid: true means it will not be turned away for a reason we already know about.

warnings are footguns that deploy fine and then hurt: an unpinned image, no restart policy, a published port that bypasses the reverse proxy, privileged, host networking — plus the privacy findings that matter on this product: third-party CDN/font/analytics origins, public DNS resolvers, hardcoded timezones, literal secrets, outbound mail, and a Tor mirror published alongside multiple clearnet routes.

Every finding carries a fix.

A POST that changes nothing: a manifest does not fit in a query string. The route is pinned to the read scope for that reason.