fix: add safe frontend rebuild workflow

scripts/cli.ts

@@ -1,6 +1,6 @@
 import { readConfig } from "./src/config";
 import { debugDispatch, debugHealth, debugTask, isDebugDispatchCommand, type DebugDispatchCommand } from "./src/debug";
-import { stackLogs, stackStatus, startStack, stopStack } from "./src/docker";
+import { isRebuildableService, rebuildService, stackLogs, stackStatus, startStack, stopStack } from "./src/docker";
 import { runE2E } from "./src/e2e";
 import { emitError, emitJson } from "./src/output";
 import { jobWithTail, listJobs, readJob, runJob } from "./src/jobs";
@@ -25,6 +25,7 @@ function help(): unknown {
       { command: "server stop", description: "Fire-and-forget docker-compose down for the fixed UniDesk stack." },
       { command: "server status", description: "Show fixed ports, containers, service health, and public URLs." },
       { command: "server logs [--tail-bytes N]", description: "Return bounded tails from file logs and docker logs." },
+      { command: "server rebuild <backend-core|frontend|provider-gateway>", description: "Build first, then label-replace one service without Docker Compose v1 recreate fallback." },
       { command: "ssh <providerId> [ssh-like args...]", description: "Open a Host SSH / WSL SSH maintenance session through the provider-gateway bridge." },
       { command: "job list", description: "List async jobs from .state/jobs." },
       { command: "job status <jobId|latest> [--tail-bytes N]", description: "Show job state with bounded stdout/stderr tails." },
@@ -141,6 +142,13 @@ async function main(): Promise<void> {
       emitJson(commandName, stackLogs(config, numberOption("--tail-bytes", 3000)));
       return;
     }
+    if (sub === "rebuild") {
+      if (!isRebuildableService(third)) {
+        throw new Error("server rebuild requires one of: backend-core, frontend, provider-gateway");
+      }
+      emitJson(commandName, rebuildService(config, third));
+      return;
+    }
   }
 
   if (top === "job") {