chore(api): update Aspire to 13.6.1

[MendesMat]

Closes #44

What

Updates Aspire from 13.5.4 to 13.6.1 in its three places: the packages Aspire.Hosting.PostgreSQL and Aspire.Npgsql.EntityFrameworkCore.PostgreSQL (Directory.Packages.props), the Aspire.AppHost.Sdk (ControlService.AppHost.csproj) and the stack line in AGENTS.md.

Why

Dependabot's #41 bumps the two packages but leaves the AppHost SDK on 13.5.4, and its green CI does not prove that the system starts, because CI never runs the AppHost. This pull request delivers the three components on the same version and records the manual start-up check. No business rule changes; decisions 31 and 32 stay as they are. #41 was not touched.

Tests

No product behavior changes, so there is no new automated test and no Red. The checks are the ones of the issue, run on 2026-10-07.

• T01 — Deve compilar e passar em toda a suíte com os três componentes do Aspire em 13.6.1
• T02 — Deve subir o AppHost com o PostgreSQL e a API
• T03 — Deve responder no endpoint de saúde da API
• T04 — Deve manter o volume do banco

Evidence:

ID	Command	Output
T01	powershell.exe -NoProfile -File check.ps1	exit code 0; build with 0 warnings and 0 errors; 243 tests, 243 passed, 0 failed, 0 skipped; project.assets.json of the AppHost resolves Aspire.Hosting, Aspire.Hosting.AppHost and Aspire.Hosting.PostgreSQL at 13.6.1
T02	dotnet run --project src/ControlService.AppHost	Aspire AppHost version: 13.6.1, Login to the dashboard at https://localhost:17150/login?t=..., Distributed application started., no error; docker ps: controlservice-postgres Up
T03	curl.exe -k https://localhost:7243/health	status 200, body Healthy
T04	docker volume inspect controlservice-postgres-data before and after	2026-09-30T06:15:36Z both times

Notes:

• The persistent container controlservice-postgres was recreated by 13.6.1 (ID a6076d0a327a before, 8e7778ba8a7f after), as the issue anticipated. The volume was reused and the API connected to it with the existing password.
• The AppHost did not try to trust the development certificate: the ASPIRE010 suppression still works.
• The dashboard now writes its run history to %USERPROFILE%\.aspire\dashboard\runs\<timestamp>\dashboard.db (SQLite, not encrypted), outside the repository.
• A search for 13.5 in the repository (outside bin/ and obj/) finds nothing.

How to test

From backend/ControlService, with Docker Desktop running:

1. powershell.exe -NoProfile -File check.ps1
2. dotnet run --project src/ControlService.AppHost
3. curl.exe -k https://localhost:7243/health → Healthy
4. docker volume inspect controlservice-postgres-data → created on 2026-09-30

Checklist

• Developed test-first: not applicable, a version update has no behavior to drive with a failing test (stated in the issue)
• check.ps1 passes locally: build without warnings and all tests
• Nothing beyond the issue: no package, abstraction, migration or contract change it does not authorize
• Documentation updated: AGENTS.md; docs/ does not change
• User-facing messages are verbatim from the feature document (CNV-16): none changed