fix(pipelock): auto-allow supervise hostname like cred-proxy

When PR #19 added the supervise sidecar (PRD 0013), I forgot to
mirror the cred-proxy auto-allow in pipelock_effective_allowlist.
The agent's HTTP_PROXY points at pipelock, so a request for
http://supervise:9100/ (the MCP endpoint claude-code dials) arrives
at pipelock as hostname `supervise` — and pipelock 403s it because
the host isn't in api_allowlist.

End-user symptom: even after `claude mcp add` registers the
supervise server, `/mcp` shows it as ✘ failed and the supervise
sidecar's docker logs are silent (request never gets through).

Mirror what cred-proxy already does: when bottle.supervise is True,
add SUPERVISE_HOSTNAME to the rendered pipelock allowlist. New tests
cover both the auto-add and the no-add-when-disabled invariants.

Existing bottles: the dashboard `pipelock edit <bottle>` verb (or
backend.docker.pipelock_apply.apply_allowlist_change) can apply
this fix to a running bottle without a relaunch.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/unit/test_pipelock_allowlist.py

@@ -91,6 +91,21 @@ class TestAllowlistWithTokens(unittest.TestCase):
         eff = pipelock_effective_allowlist(_bottle({}))
         self.assertNotIn("cred-proxy", eff)
 
+    def test_supervise_hostname_auto_added_when_supervise_enabled(self):
+        # Same reasoning as cred-proxy: the agent's HTTP_PROXY points
+        # at pipelock, so http://supervise:9100/ (the MCP endpoint)
+        # arrives at pipelock as hostname `supervise`. Without this
+        # auto-allow, claude-code's MCP client gets a 403 and the
+        # supervise server shows up as "failed" in /mcp.
+        eff = pipelock_effective_allowlist(_bottle({"supervise": True}))
+        self.assertIn("supervise", eff)
+
+    def test_supervise_hostname_NOT_added_when_disabled(self):
+        eff = pipelock_effective_allowlist(_bottle({}))
+        self.assertNotIn("supervise", eff)
+        eff_explicit = pipelock_effective_allowlist(_bottle({"supervise": False}))
+        self.assertNotIn("supervise", eff_explicit)
+
 
 class TestTlsPassthrough(unittest.TestCase):
     def test_default_includes_api_anthropic(self):