feat: Update web UI for domain-keyed service model

- RegisteredService: removed name, added subdomains bool
- CertEntry: removed service field (domain is the key)
- Ingress page: domain as primary label, subdomains badge
- Certificates page: source shown under domain
- All type-check passes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/src/components/IngressProxyComponent.tsx

@@ -154,7 +154,7 @@ export function IngressProxyComponent() {
           ) : services.length > 0 ? (
             <div className="border rounded-lg divide-y text-sm">
               {services.map(s => (
-                <div key={s.name} className="px-3 py-2">
+                <div key={s.domain} className="px-3 py-2">
                   <div className="flex items-center justify-between">
                     <div className="flex items-center gap-2">
                       {s.reach === 'public' ? (
@@ -162,8 +162,10 @@ export function IngressProxyComponent() {
                       ) : (
                         <Server className="h-3.5 w-3.5 text-green-500 shrink-0" />
                       )}
-                      <span className="font-medium">{s.name}</span>
-                      <span className="font-mono text-xs text-muted-foreground">{s.domain}</span>
+                      <span className="font-mono font-medium">{s.domain}</span>
+                      {s.subdomains && (
+                        <Badge variant="outline" className="text-xs h-4 px-1">*.{s.domain}</Badge>
+                      )}
                     </div>
                     <span className="font-mono text-xs text-muted-foreground">{s.backend.address}</span>
                   </div>