refactor: Replace 'reach' field with 'public' boolean in service registration and related components

internal/api/v1/helpers.go

@@ -52,7 +52,7 @@ func (api *API) EnsureCentralService() {
 			Address: backend,
 			Type:    services.BackendHTTP,
 		},
-		Reach: services.ReachInternal,
+		// Public defaults to false (private)
 		TLS:   services.TLSTerminate,
 	})
 }
@@ -159,7 +159,7 @@ func (api *API) reconcileNetworking() {
 		ic := config.InstanceConfig{}
 		ic.Cluster.LoadBalancerIp = dnsIP
 
-		if svc.Reach == services.ReachInternal {
+		if !svc.Public {
 			// Internal-only: local=/ prevents upstream DNS forwarding
 			ic.Cloud.InternalDomain = svc.Domain
 		} else {