feat: Add tests for config, secrets, services, and cloudflare endpoints

Fix config endpoint to return wrapped { configured, config } response
that the web UI expects. Fix services handler to return stored version
with defaults applied.

New tests:
- GetGlobalConfig: wrapped response, empty/not-configured case
- GetGlobalSecrets: leaf redaction preserves structure, raw mode
- UpdateGlobalConfig: write and verify
- CloudflareVerify: no-token case
- Services: register, list, get, update, deregister, TCP passthrough
  defaults, validation errors

15 new test cases, all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/api/v1/handlers_services.go

@@ -53,9 +53,11 @@ func (api *API) ServicesRegister(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Return the stored version (has defaults applied)
+	stored, _ := api.services.Get(svc.Name)
 	respondJSON(w, http.StatusCreated, map[string]any{
 		"message": fmt.Sprintf("Service %q registered", svc.Name),
-		"service": svc,
+		"service": stored,
 	})
 }