feat: Add tests for config, secrets, services, and cloudflare endpoints

Fix config endpoint to return wrapped { configured, config } response
that the web UI expects. Fix services handler to return stored version
with defaults applied.

New tests:
- GetGlobalConfig: wrapped response, empty/not-configured case
- GetGlobalSecrets: leaf redaction preserves structure, raw mode
- UpdateGlobalConfig: write and verify
- CloudflareVerify: no-token case
- Services: register, list, get, update, deregister, TCP passthrough
  defaults, validation errors

15 new test cases, all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/api/v1/handlers.go

@@ -230,12 +230,14 @@ func (api *API) RegisterRoutes(r *mux.Router) {
 
 // --- Global Config/Secrets handlers ---
 
-// GetGlobalConfig returns the global config
+// GetGlobalConfig returns the global config wrapped in { configured, config }.
 func (api *API) GetGlobalConfig(w http.ResponseWriter, r *http.Request) {
 	configPath := filepath.Join(api.dataDir, "config.yaml")
 	data, err := os.ReadFile(configPath)
 	if err != nil {
-		respondError(w, http.StatusInternalServerError, "Failed to read config")
+		respondJSON(w, http.StatusOK, map[string]any{
+			"configured": false,
+		})
 		return
 	}
 
@@ -245,7 +247,10 @@ func (api *API) GetGlobalConfig(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	respondJSON(w, http.StatusOK, configMap)
+	respondJSON(w, http.StatusOK, map[string]any{
+		"configured": true,
+		"config":     configMap,
+	})
 }
 
 // UpdateGlobalConfig updates the global config