test: Add 22 unit tests across dnsmasq, haproxy, services

dnsmasq (6 new, 30.8% → 32%):
- Empty instances, multiple instances, nil config, configured IP
- No leaked empty entries (address=//, local=//)
- Empty fields don't produce broken entries

Also fixed a bug: empty Domain/InternalDomain fields in commented-out
entries (no LB IP case) now guarded against producing # local=// and
# address=// directives.

haproxy (7 new):
- No HTTPS frontend with no routes
- HTTP-only and L4-only route scenarios
- CertsDir customization and default
- Custom TCP route ports
- Health check directive in L7 backends

services (8 new, 72.7% → 75.8%):
- Not-found errors for Get, Deregister, Update
- DeregisterBySource partial match (source AND backend)
- Overwrite preserves file count
- Empty dir and non-YAML file handling

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/haproxy/config_test.go

@@ -424,3 +424,147 @@ func TestGenerateWithOpts_BackwardCompatible(t *testing.T) {
 		t.Errorf("backward compat: unexpected L7 frontend, got:\n%s", out)
 	}
 }
+
+func TestGenerateWithOpts_NoRoutes_NoHTTPSFrontend(t *testing.T) {
+	m := NewManager("")
+
+	// No instances, no HTTP routes
+	out := m.GenerateWithOpts(nil, nil, GenerateOpts{})
+
+	if strings.Contains(out, "frontend https_in") {
+		t.Errorf("expected no HTTPS frontend with empty instances and empty HTTP routes, got:\n%s", out)
+	}
+	if strings.Contains(out, "frontend l7_https") {
+		t.Errorf("expected no L7 frontend with no HTTP routes, got:\n%s", out)
+	}
+}
+
+func TestGenerateWithOpts_OnlyHTTPRoutes(t *testing.T) {
+	m := NewManager("")
+
+	httpRoutes := []HTTPRoute{
+		{Name: "my-api", Domain: "api.example.com", Backend: "192.168.1.10:9001"},
+	}
+
+	out := m.GenerateWithOpts(nil, nil, GenerateOpts{HTTPRoutes: httpRoutes})
+
+	// HTTPS frontend should be present (needed for SNI dispatch to L7)
+	if !strings.Contains(out, "frontend https_in") {
+		t.Errorf("expected HTTPS frontend when HTTP routes present, got:\n%s", out)
+	}
+	// L7 frontend should be present
+	if !strings.Contains(out, "frontend l7_https") {
+		t.Errorf("expected L7 frontend for HTTP routes, got:\n%s", out)
+	}
+	// L7 backend should be present
+	if !strings.Contains(out, "backend be_l7_my_api") {
+		t.Errorf("expected L7 backend for my-api, got:\n%s", out)
+	}
+	// No L4 instance backends
+	if strings.Contains(out, "be_https_") {
+		t.Errorf("unexpected L4 instance backend when only HTTP routes, got:\n%s", out)
+	}
+}
+
+func TestGenerateWithOpts_OnlyL4Routes(t *testing.T) {
+	m := NewManager("")
+
+	instances := []InstanceRoute{
+		{Name: "cloud", Domain: "cloud.example.com", BackendIP: "10.0.0.1", Subdomains: true},
+	}
+
+	out := m.GenerateWithOpts(instances, nil, GenerateOpts{})
+
+	// HTTPS frontend should exist for L4 SNI routing
+	if !strings.Contains(out, "frontend https_in") {
+		t.Errorf("expected HTTPS frontend for L4 routes, got:\n%s", out)
+	}
+	// L4 backend should exist
+	if !strings.Contains(out, "backend be_https_cloud") {
+		t.Errorf("expected L4 backend, got:\n%s", out)
+	}
+	// No L7 frontend when no HTTP routes
+	if strings.Contains(out, "frontend l7_https") {
+		t.Errorf("unexpected L7 frontend with only L4 routes, got:\n%s", out)
+	}
+	// No L7 termination backend
+	if strings.Contains(out, "be_l7_termination") {
+		t.Errorf("unexpected L7 termination backend with only L4 routes, got:\n%s", out)
+	}
+}
+
+func TestGenerateWithOpts_CertsDir(t *testing.T) {
+	m := NewManager("")
+
+	httpRoutes := []HTTPRoute{
+		{Name: "app", Domain: "app.example.com", Backend: "127.0.0.1:8080"},
+	}
+
+	out := m.GenerateWithOpts(nil, nil, GenerateOpts{
+		HTTPRoutes: httpRoutes,
+		CertsDir:   "/opt/certs/wildcard/",
+	})
+
+	if !strings.Contains(out, "ssl crt /opt/certs/wildcard/") {
+		t.Errorf("expected custom CertsDir in L7 bind, got:\n%s", out)
+	}
+}
+
+func TestGenerateWithOpts_DefaultCertsDir(t *testing.T) {
+	m := NewManager("")
+
+	httpRoutes := []HTTPRoute{
+		{Name: "app", Domain: "app.example.com", Backend: "127.0.0.1:8080"},
+	}
+
+	// Empty CertsDir should default to /etc/haproxy/certs/
+	out := m.GenerateWithOpts(nil, nil, GenerateOpts{
+		HTTPRoutes: httpRoutes,
+		CertsDir:   "",
+	})
+
+	if !strings.Contains(out, "ssl crt /etc/haproxy/certs/") {
+		t.Errorf("expected default CertsDir /etc/haproxy/certs/ in L7 bind, got:\n%s", out)
+	}
+}
+
+func TestGenerate_CustomRoutePorts(t *testing.T) {
+	m := NewManager("")
+
+	custom := []CustomRoute{
+		{Name: "ssh", Port: 2222, Backend: "192.168.1.10:22"},
+		{Name: "mqtt", Port: 1883, Backend: "192.168.1.20:1883"},
+	}
+
+	out := m.Generate(nil, custom)
+
+	if !strings.Contains(out, "bind *:2222") {
+		t.Errorf("expected bind on port 2222, got:\n%s", out)
+	}
+	if !strings.Contains(out, "bind *:1883") {
+		t.Errorf("expected bind on port 1883, got:\n%s", out)
+	}
+	if !strings.Contains(out, "server s0 192.168.1.10:22") {
+		t.Errorf("expected SSH backend, got:\n%s", out)
+	}
+	if !strings.Contains(out, "server s0 192.168.1.20:1883") {
+		t.Errorf("expected MQTT backend, got:\n%s", out)
+	}
+}
+
+func TestGenerateWithOpts_HealthCheckInL7Backend(t *testing.T) {
+	m := NewManager("")
+
+	httpRoutes := []HTTPRoute{
+		{Name: "api", Domain: "api.example.com", Backend: "10.0.0.5:8080", HealthPath: "/healthz"},
+	}
+
+	out := m.GenerateWithOpts(nil, nil, GenerateOpts{HTTPRoutes: httpRoutes})
+
+	if !strings.Contains(out, "option httpchk GET /healthz") {
+		t.Errorf("expected httpchk directive with health path, got:\n%s", out)
+	}
+	if !strings.Contains(out, "server s0 10.0.0.5:8080 check") {
+		t.Errorf("expected server line with 'check' flag for health check, got:\n%s", out)
+	}
+}