Single Fuseki with a dataset per dataspace as the default stack

[namedgraph]

Makes the single-Fuseki, dataset-per-dataspace layout the default stack — mirroring linkeddatahub.com (AtomGraph/linkeddatahub.com#8) so open-source deployments get the same per-dataspace isolation, and matching the docs (AtomGraph/LinkedDataHub-Apps#61).

One Fuseki, a dataset per dataspace role

• fuseki-admin and fuseki-end-user become a single fuseki service mounting ./fuseki.
• config/fuseki/config.ttl declares an end-user and an admin dataset per dataspace, named after the dataspace origin (deployment host dropped, role appended): end-user, admin, northwind-traders.demo.end-user, northwind-traders.demo.admin, each in its own TDB2 folder, each with the 60 s query timeout on its query endpoint.
• config/system.trig gives northwind-traders its own services (no longer reusing root's) and points every service at http://fuseki:3030/<dataset>/.
• Heap and mem_limit are the former two combined (2304m in 4608m).
• No entrypoint change: it already loads each app into the store URL its own sd:Service declares, and CI/dev start empty and load fixtures — so no data migration.

Two Varnish, kept

varnish-admin and varnish-end-user are unchanged, both now fronting the single fuseki (VCL .host default → fuseki). The admin/end-user split is a boundary the platform already routes on (BACKEND_PROXY_ADMIN/_END_USER); the two role VCLs stay cohesive (admin xkey/XKEY-PURGE, end-user query-ban), and their separate storage pools keep end-user query churn from evicting the small hot admin cache. Merging into one cache would rebuild that isolation inside a single container via dataset-name parsing — the less principled choice — so they are left separate. egress is unchanged; both stores already route SERVICE/LOAD through it.

Tests follow the single server

• http-tests/config/system.trig: root and the test dataspace both point at fuseki:3030/end-user/ and …/admin/. test keeps sharing root's datasets — the admin/acl/* tests write a fake admin.test.localhost authorization and assert root filters it out by base URI; giving test its own dataset would make them pass for the wrong reason and stop exercising the filter.
• http-tests/run.sh, the http-tests and debug compose overrides, ui-tests/lib/stack.mjs, bin/sitemap/generate-sitemap.sh: drop the 3031 end-user port; datasets are addressed by path on the one 3030.
• The internal-SERVICE tests (GET/POST-sparql-service-internal, PATCH-service-internal, import-rdf-service-internal, GET-proxied-internal-403) now target fuseki:3030/admin/, so they still prove an internal dataset is refused.

Verification

• riot --validate passes for config/fuseki/config.ttl, config/system.trig, http-tests/config/system.trig; bash -n clean for the changed scripts.
• docker compose config renders base+override, base+debug and base+http-tests — one fuseki, two Varnish, egress, sef-compiler.
• A throwaway atomgraph/fuseki:6.1.0 on the new config.ttl serves all four datasets (query/update/OPTIONS) and creates the four ./fuseki/<name>/DB2 folders.
• The full HTTP and UI suites run in CI (they build the image and bring up the stack) — the end-to-end check, including the acl/* filtering and internal-SERVICE tests.

Not in scope

• Per-dataspace sitemaps (item 8) — already on develop.
• docker-compose.override.yml is a per-developer, gitignored file; not committed (bump its fuseki port mapping locally).

🤖 Generated with Claude Code