test: Add 22 unit tests across dnsmasq, haproxy, services

dnsmasq (6 new, 30.8% → 32%):
- Empty instances, multiple instances, nil config, configured IP
- No leaked empty entries (address=//, local=//)
- Empty fields don't produce broken entries

Also fixed a bug: empty Domain/InternalDomain fields in commented-out
entries (no LB IP case) now guarded against producing # local=// and
# address=// directives.

haproxy (7 new):
- No HTTPS frontend with no routes
- HTTP-only and L4-only route scenarios
- CertsDir customization and default
- Custom TCP route ports
- Health check directive in L7 backends

services (8 new, 72.7% → 75.8%):
- Not-found errors for Get, Deregister, Update
- DeregisterBySource partial match (source AND backend)
- Overwrite preserves file count
- Empty dir and non-YAML file handling

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/dnsmasq/config_modular.go

@@ -112,9 +112,13 @@ func (g *ConfigGenerator) GenerateInstanceConfig(instance config.InstanceConfig)
 	if loadBalancerIP == "" {
 		sb.WriteString("# WARNING: No load balancer IP configured for this instance\n")
 		sb.WriteString("# DNS entries are commented out until load balancer IP is configured\n\n")
-		fmt.Fprintf(&sb, "# local=/%s/\n", instance.Cloud.InternalDomain)
-		fmt.Fprintf(&sb, "# address=/%s/<load-balancer-ip>\n\n", instance.Cloud.InternalDomain)
-		fmt.Fprintf(&sb, "# address=/%s/<load-balancer-ip>\n", instance.Cloud.Domain)
+		if instance.Cloud.InternalDomain != "" {
+			fmt.Fprintf(&sb, "# local=/%s/\n", instance.Cloud.InternalDomain)
+			fmt.Fprintf(&sb, "# address=/%s/<load-balancer-ip>\n\n", instance.Cloud.InternalDomain)
+		}
+		if instance.Cloud.Domain != "" {
+			fmt.Fprintf(&sb, "# address=/%s/<load-balancer-ip>\n", instance.Cloud.Domain)
+		}
 	} else {
 		// Internal domain (.internal.cloud.example.tld) - local only, no external DNS
 		if instance.Cloud.InternalDomain != "" {