Show routes, TLS certs, and port-forwarding on services page

- Add Routes model to services UI (paths, headers, IP whitelisting per route)
- Show TLS cert info per service with inline provision/renew actions
- Remove TLS Certificates section from dashboard (now on services page)
- Make gateway router port list dynamic from config + VPN state
- Add TODO for header validation in HAProxy config generation

CLAUDE.md

@@ -37,6 +37,7 @@ make check  # Lint + test
 ### Environment Variables
 
 - `WILD_CENTRAL_DATA_DIR` — Data directory (default: `/var/lib/wild-central`)
+- `WILD_CENTRAL_PORT` — API listen port (default: `5055`)
 - `WILD_CENTRAL_NATS_PORT` — NATS listen port (default: `4222`)
 - `WILD_CENTRAL_DNSMASQ_CONFIG_PATH` — dnsmasq config path
 - `WILD_CENTRAL_HAPROXY_CONFIG_PATH` — HAProxy config path
@@ -46,6 +47,15 @@ make check  # Lint + test
 - `WILD_CENTRAL_STATIC_DIR` — Web UI static files directory
 - `WILD_CENTRAL_VITE_URL` — Vite dev server URL for frontend proxying
 
+### Data Directory
+
+Runtime state is persisted in `{WILD_CENTRAL_DATA_DIR}/`:
+- `state.yaml` — operator, domain, firewall, DDNS, DHCP settings (managed via API)
+- `secrets.yaml` — API tokens and credentials
+- `services/` — per-domain service registration files
+- `nats/` — embedded NATS JetStream data
+- `instances/` — Wild Cloud instance configs
+
 ## Service Registration API
 
 The key abstraction. Services register with Central to get DNS, proxy, TLS, and public exposure.
@@ -62,15 +72,14 @@ DELETE /api/v1/services/{name}       Deregister service
 
 ```json
 {
-  "name": "my-api",
-  "source": "wild-works",
   "domain": "my-api.payne.io",
+  "source": "wild-works",
   "backend": {
     "address": "192.168.8.60:9001",
     "type": "http",
     "health": "/health"
   },
-  "reach": "internal",
+  "public": false,
   "tls": "terminate"
 }
 ```
@@ -81,8 +90,7 @@ DELETE /api/v1/services/{name}       Deregister service
 - `http` — L7, Central terminates TLS with wildcard cert (Wild Works services)
 - `static` — L7, static file serving (Wild Works frontends)
 
-### Reach levels
+### Public
 
-- `off` — localhost only
-- `internal` — LAN-visible (DNS + proxy + TLS)
-- `public` — internet-visible (+ tunnel or direct exposure)
+- `false` (default) — LAN-visible only (DNS + proxy + TLS)
+- `true` — internet-visible (+ DDNS or tunnel exposure)