feat: Domain-keyed service registration model

Rewrite the service registration model per the architecture plan:

Model changes:
- Domain is the unique key (removed Name field)
- Removed ExtraDomains — each domain is its own registration
- Removed SourceNode, BackendStatic, ReachOff
- Added Subdomains bool for wildcard matching control
- Files stored as <domain_with_underscores>.yaml
- API routes: /services/{domain:.+} (regex for dots in path)
- Added DeregisterBySource for cleanup before re-registration

Reconciliation changes:
- No ExtraDomains iteration — each service IS one domain
- reach:internal → sets InternalDomain (generates local=/)
- reach:public → sets Domain (no local=/)
- tcp-passthrough → DNS points to backend IP
- http → DNS points to Central IP

All 22 tests pass (9 manager + 8 handler + 5 config/cert).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/api/v1/handlers_certbot.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/wild-cloud/wild-central/internal/config"
+	"github.com/wild-cloud/wild-central/internal/services"
 )
 
 // CertStatus returns TLS certificate status for all relevant domains:
@@ -27,7 +28,7 @@ func (api *API) CertStatus(w http.ResponseWriter, r *http.Request) {
 
 	svcs, _ := api.services.List()
 	for _, svc := range svcs {
-		if svc.TLS != "terminate" || svc.Domain == "" {
+		if svc.TLS != services.TLSTerminate || svc.Domain == "" {
 			continue
 		}
 		if seen[svc.Domain] {
@@ -39,7 +40,7 @@ func (api *API) CertStatus(w http.ResponseWriter, r *http.Request) {
 
 		entry := map[string]any{
 			"domain":  svc.Domain,
-			"service": svc.Name,
+			"service": svc.Domain,
 			"source":  svc.Source,
 			"cert":    status,
 		}