feat(railpack): add buildpack control var filtering and dev seeder

Extract NIXPACKS_/RAILPACK_ prefix filtering into a reusable
`scopeWithoutBuildpackControlVariables` query scope on EnvironmentVariable.
Apply scope consistently to runtime vars, runtime preview vars, and
buildtime var generation in ApplicationDeploymentJob.

Refactor `generate_railpack_env_variables` to return a Collection.
Add `RAILPACK_FRONTEND_IMAGE` constant and bake it into the
coolify-helper Dockerfile as a build arg.

Add DevelopmentRailpackExamplesSeeder (dev/local env only) for
seeding example Railpack apps, wired into DatabaseSeeder.

Add tests:
- ApplicationDeploymentControlVarFilteringTest: verifies control vars
  are excluded from runtime and buildtime envs
- DevelopmentRailpackExamplesSeederTest: verifies seeder behavior
- ApplicationDeploymentRailpackEnvParityTest: parity checks for env
  handling across build/runtime paths

tests/Unit/ApplicationDeploymentRailpackConfigTest.php

@@ -30,6 +30,9 @@ function makeRailpackDeploymentJob(array $applicationAttributes = [], array $sav
         'deployment_uuid' => 'deployment-uuid',
         'saved_outputs' => new Collection($savedOutputs),
         'env_railpack_args' => "--env 'RAILPACK_NODE_VERSION=22'",
+        'force_rebuild' => false,
+        'addHosts' => '',
+        'secrets_hash_key' => 'testing-app-key',
     ] as $property => $value) {
         $reflectionProperty = $reflection->getProperty($property);
         $reflectionProperty->setAccessible(true);
@@ -175,6 +178,9 @@ it('builds railpack prepare command using railpack env for install and cli flags
             'start_command' => 'node server.js',
         ],
     );
+    $envRailpackArgsProperty = $reflection->getProperty('env_railpack_args');
+    $envRailpackArgsProperty->setAccessible(true);
+    $envRailpackArgsProperty->setValue($job, "--env 'RAILPACK_NODE_VERSION=22' --env 'RAILPACK_INSTALL_CMD=npm ci'");
 
     $command = invokeRailpackMethod(
         $job,
@@ -184,8 +190,8 @@ it('builds railpack prepare command using railpack env for install and cli flags
     );
 
     expect($command)->toContain('railpack prepare');
-    expect($command)->toContain('--env '.escapeshellarg('RAILPACK_INSTALL_CMD=npm ci'));
     expect($command)->toContain("--env 'RAILPACK_NODE_VERSION=22'");
+    expect($command)->toContain("--env 'RAILPACK_INSTALL_CMD=npm ci'");
     expect($command)->toContain('--build-cmd '.escapeshellarg('npm run build'));
     expect($command)->toContain('--start-cmd '.escapeshellarg('node server.js'));
     expect($command)->toContain('--config-file '.escapeshellarg('.coolify/railpack.generated.json'));
@@ -195,3 +201,32 @@ it('builds railpack prepare command using railpack env for install and cli flags
     expect($command)->not->toContain('RAILPACK_BUILD_CMD=');
     expect($command)->not->toContain('RAILPACK_START_CMD=');
 });
+
+it('builds railpack docker command with matching env and secret flags for all railpack variables', function () {
+    [$job, $reflection] = makeRailpackDeploymentJob([
+        'uuid' => 'application-uuid',
+    ]);
+
+    $command = invokeRailpackMethod(
+        $job,
+        $reflection,
+        'railpack_build_command',
+        [
+            'coollabsio/coolify:test',
+            collect([
+                'RAILPACK_NODE_VERSION' => '22',
+                'RAILPACK_INSTALL_CMD' => 'npm ci && npm run postinstall',
+                'SECRET_JSON' => '{"token":"abc"}',
+            ]),
+        ],
+    );
+
+    expect($command)->toContain("env RAILPACK_NODE_VERSION='22'");
+    expect($command)->toContain("RAILPACK_INSTALL_CMD='npm ci && npm run postinstall'");
+    expect($command)->toContain("SECRET_JSON='{\"token\":\"abc\"}'");
+    expect($command)->toContain('--secret id=RAILPACK_NODE_VERSION,env=RAILPACK_NODE_VERSION');
+    expect($command)->toContain('--secret id=RAILPACK_INSTALL_CMD,env=RAILPACK_INSTALL_CMD');
+    expect($command)->toContain('--secret id=SECRET_JSON,env=SECRET_JSON');
+    expect($command)->toContain(' --build-arg secrets-hash=');
+    expect($command)->toContain('--build-arg BUILDKIT_SYNTAX="${RAILPACK_FRONTEND_IMAGE}"');
+});

tests/Unit/ApplicationDeploymentRailpackEnvParityTest.php

@@ -0,0 +1,124 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\EnvironmentVariable;
+use App\Models\Server;
+
+it('generates escaped railpack env args from resolved values and includes install command', function () {
+    $application = Mockery::mock(Application::class);
+    $application->shouldReceive('getAttribute')->with('install_command')->andReturn('npm ci && npm run postinstall');
+
+    $nodeVersion = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $nodeVersion->forceFill([
+        'key' => 'RAILPACK_NODE_VERSION',
+        'is_literal' => false,
+        'is_multiline' => false,
+    ]);
+    $nodeVersion->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn('22');
+
+    $literalValue = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $literalValue->forceFill([
+        'key' => 'RAILPACK_CUSTOM_FLAG',
+        'is_literal' => true,
+        'is_multiline' => false,
+    ]);
+    $literalValue->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn("'hello world'");
+
+    $jsonValue = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $jsonValue->forceFill([
+        'key' => 'RAILPACK_JSON',
+        'is_literal' => false,
+        'is_multiline' => false,
+    ]);
+    $jsonValue->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn('{"token":"abc"}');
+
+    $nullValue = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $nullValue->forceFill([
+        'key' => 'RAILPACK_NULL',
+        'is_literal' => false,
+        'is_multiline' => false,
+    ]);
+    $nullValue->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn(null);
+
+    $application->shouldReceive('getAttribute')
+        ->with('railpack_environment_variables')
+        ->andReturn(collect([$nodeVersion, $literalValue, $jsonValue, $nullValue]));
+
+    $job = Mockery::mock(ApplicationDeploymentJob::class)->makePartial();
+    $job->shouldAllowMockingProtectedMethods();
+
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $applicationProperty = $reflection->getProperty('application');
+    $applicationProperty->setAccessible(true);
+    $applicationProperty->setValue($job, $application);
+
+    $pullRequestProperty = $reflection->getProperty('pull_request_id');
+    $pullRequestProperty->setAccessible(true);
+    $pullRequestProperty->setValue($job, 0);
+
+    $mainServerProperty = $reflection->getProperty('mainServer');
+    $mainServerProperty->setAccessible(true);
+    $mainServerProperty->setValue($job, Mockery::mock(Server::class));
+
+    $method = $reflection->getMethod('generate_railpack_env_variables');
+    $method->setAccessible(true);
+    $variables = $method->invoke($job);
+
+    $envArgsProperty = $reflection->getProperty('env_railpack_args');
+    $envArgsProperty->setAccessible(true);
+    $envArgs = $envArgsProperty->getValue($job);
+
+    expect($variables->all())->toBe([
+        'RAILPACK_NODE_VERSION' => '22',
+        'RAILPACK_CUSTOM_FLAG' => 'hello world',
+        'RAILPACK_JSON' => '{"token":"abc"}',
+        'RAILPACK_INSTALL_CMD' => 'npm ci && npm run postinstall',
+    ]);
+    expect($envArgs)->toContain("--env 'RAILPACK_NODE_VERSION=22'");
+    expect($envArgs)->toContain("--env 'RAILPACK_CUSTOM_FLAG=hello world'");
+    expect($envArgs)->toContain("--env 'RAILPACK_JSON={\"token\":\"abc\"}'");
+    expect($envArgs)->toContain("--env 'RAILPACK_INSTALL_CMD=npm ci && npm run postinstall'");
+    expect($envArgs)->not->toContain('RAILPACK_NULL');
+});
+
+it('uses preview railpack environment variables for preview deployments', function () {
+    $application = Mockery::mock(Application::class);
+    $application->shouldReceive('getAttribute')->with('install_command')->andReturn(null);
+
+    $previewValue = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $previewValue->forceFill([
+        'key' => 'RAILPACK_PREVIEW_ONLY',
+        'is_literal' => false,
+        'is_multiline' => false,
+    ]);
+    $previewValue->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn('preview-value');
+
+    $application->shouldReceive('getAttribute')
+        ->with('railpack_environment_variables_preview')
+        ->andReturn(collect([$previewValue]));
+
+    $job = Mockery::mock(ApplicationDeploymentJob::class)->makePartial();
+    $job->shouldAllowMockingProtectedMethods();
+
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $applicationProperty = $reflection->getProperty('application');
+    $applicationProperty->setAccessible(true);
+    $applicationProperty->setValue($job, $application);
+
+    $pullRequestProperty = $reflection->getProperty('pull_request_id');
+    $pullRequestProperty->setAccessible(true);
+    $pullRequestProperty->setValue($job, 42);
+
+    $mainServerProperty = $reflection->getProperty('mainServer');
+    $mainServerProperty->setAccessible(true);
+    $mainServerProperty->setValue($job, Mockery::mock(Server::class));
+
+    $method = $reflection->getMethod('generate_railpack_env_variables');
+    $method->setAccessible(true);
+    $variables = $method->invoke($job);
+
+    expect($variables->all())->toBe([
+        'RAILPACK_PREVIEW_ONLY' => 'preview-value',
+    ]);
+});