feat: probe reverse-proxy vhosts in get_lab_status

[italovalcy]

Summary

After a lab instance is created, the status page polls /api/lab/status/<id> until all k8s resources are ready and then sends the user to the Lab Instance view. When PROXY_DOMAIN is configured, the proxied service links only work once the reverse-proxy vhost is actually served, which can lag behind the pods becoming Running.

This augments get_lab_status so that, once all resources are ok, it also probes the candidate reverse-proxy vhosts — the server-side analogue of probeProxyLink() in lab_instance_view.html — and reports each one as an extra Proxy__<host> entry in the status result. Because the status page's allOk check iterates the whole result array, the page keeps waiting until the proxied links are ready (no template change needed; the Proxy__… names simply don't match a DOM row).

Behavior

• Probing only starts once every k8s resource is is_ok.
• A vhost is reachable when it answers with any HTTP status (200/302/401/502/…); an unknown hostname is closed by nginx's default server (return 444), so the request raises → not reachable. This mirrors the browser's no-cors opaque-resolve detection.
• Each request probes once (the client keeps polling). An unreachable vhost is reported not-ok only until PROXY_PROBE_MAX_WAIT seconds have elapsed since its backing Service was created; past that deadline we stop gating on it (report ok) so a vhost that never comes up can't block the caller forever.
• PROXY_PROBE_MAX_WAIT is configurable (env var), defaults to 30s; 0 disables the probe. No proxy entries / no probing when PROXY_DOMAIN is empty, so existing deployments are unaffected.
• Probes use requests.get(verify=False) with a fixed 5s timeout (mirrors the client's 5s abort) — a reachability check, not a security check, so a served-but-untrusted cert still counts as up.

Files

• apps/api/routes.py — _build_proxy_urls() (maps each candidate vhost URL to its Service creation timestamp), _probe_proxy_vhost(), and the augmented get_lab_status.
• apps/config.py — new PROXY_PROBE_MAX_WAIT setting.
• tests/test_api_k8s.py — coverage for domain-unset (no probe), reachable → ok, unreachable-within-window → not-ok, deadline-exceeded → ok, probe-skipped-while-not-ready, and a _build_proxy_urls unit test.

Stacking

Stacked on top of #319 (fix/k8s-exec-apiclient-isolation). Review/merge the base PRs in the stack first; the base should be retargeted to main as the lower PRs merge.

Testing

pytest tests/test_api_k8s.py — 37 passed.

🤖 Generated with Claude Code