Show routes, TLS certs, and port-forwarding on services page

- Add Routes model to services UI (paths, headers, IP whitelisting per route)
- Show TLS cert info per service with inline provision/renew actions
- Remove TLS Certificates section from dashboard (now on services page)
- Make gateway router port list dynamic from config + VPN state
- Add TODO for header validation in HAProxy config generation

internal/api/v1/handlers_cloudflare.go

@@ -3,7 +3,6 @@ package v1
 import (
 	"encoding/json"
 	"net/http"
-	"path/filepath"
 )
 
 type cloudflareZone struct {
@@ -71,8 +70,7 @@ func (api *API) CloudflareSetZoneID(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	secretsPath := filepath.Join(api.dataDir, "secrets.yaml")
-	if err := api.secrets.SetSecret(secretsPath, "cloudflare.zoneId", req.ZoneID); err != nil {
+	if err := api.secrets.SetSecret("cloudflare.zoneId", req.ZoneID); err != nil {
 		respondError(w, http.StatusInternalServerError, "Failed to save zone ID")
 		return
 	}