feat: Wire up service registration to networking reconciliation

When a service is registered, updated, or deregistered, Central now
automatically regenerates HAProxy routes and dnsmasq DNS entries to
match the current set of registered services.

- L4 tcp-passthrough services (Wild Cloud) → HAProxy SNI routes
- L7 http services (Wild Works) → HAProxy Host-based reverse proxy
- All services with reach != off → dnsmasq DNS entries
- SSE events broadcast on config changes
- Reconciliation runs asynchronously (non-blocking)

This closes the loop: service registration is no longer inert — it
actually updates the networking stack.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/api/v1/handlers.go

@@ -82,6 +82,10 @@ func NewAPI(dataDir, version string, allowedOrigins []string) (*API, error) {
 		sseManager:     sseManager,
 	}
 
+	// Wire up service registration reconciliation: when services change,
+	// regenerate dnsmasq DNS entries and HAProxy routes.
+	api.services.SetReconcileFn(api.reconcileNetworking)
+
 	return api, nil
 }