[narcisonunez]

What is this PR about?

Bundles the fixes for four security issues:

• Cross-tenant write IDOR: owner/admin org-scope check missing from ~25 application mutation procedures (saveEnvironment, redeploy, domains, ports, mounts, etc.) #5635 Cross-tenant IDOR: checkServiceAccess, checkServicePermissionAndAccess and checkEnvironmentCreationPermission now require the target service/project to belong to the active organization for every role. deployment.allByType resolves the owning service for backup, volume backup and preview deployment ids so those modals keep working.
• security: confirm backup destination and certificate path guards for current source #5541 Backup and volume backup destinations are checked against the organization in the API and in the run paths. certificatePath is no longer accepted from the client and the certificate directory is confined to CERTIFICATES_PATH. Compose branch fields use the existing branch validator. Service-less web-server backups stay unscoped.
• GitHub App installation token is written to build logs when an app uses private submodules #5618 Git provider tokens go through a host-scoped http.<origin>/.extraHeader instead of the clone URL (GitHub, GitLab, Gitea). Based on fix: keep git provider tokens out of clone URLs #5619 by @Souvik-Cyclic.
• Notification bug (Slack): Build error notification message is exposing SSH keys in notification payload #5557 Build failure notifications send the deployment log tail instead of error.message. Based on fix(notifications): send the build log tail, not the build script, on build failure #5717 by @Gourav224. The key leak itself was already closed by fix: stop leaking secrets through ExecError and bind container terminal to its service #5733.

Tested locally end to end: two organizations attacking each other's ids, destinations, certificates, a private relative submodule against a token-protected git server, and a failed deploy with an SSH key reaching a Slack-compatible listener. Not exercised locally: a real pg_dump to S3 and the interactive terminal (Docker Desktop swarm and node-pty limits).

Checklist

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance.

Issues related (if applicable)

closes #5635
closes #5618
closes #5557
closes #5541

Supersedes #5619 and #5717.

Confidence Score: 5/5

The latest changes appear safe to merge; the server history access issue is fixed.

Summary

This PR tightens organization checks, checks backup destinations, confines certificate paths, moves Git tokens out of clone URLs, and uses build logs in failure notifications.

• Service and project actions stay within the active organization.
• Backup jobs use destinations owned by the backup's organization.
• Git provider clones authenticate with a host-scoped header.
• Build failure notices show the deployment log tail.
• Certificate files stay inside the certificate directory.
• Compose updates accept only valid provider branch names.

_{Reviews (2) · Last reviewed commit: "fix(deployment): restrict server deploym..." · Reviewed by Greptile}