feat: Add comprehensive tests + fix startup reconciliation

Tests added (13 new):
- HAProxy ACL ordering: L7 before L4 wildcard, L4 exact before L4 wildcard
- HAProxy subdomains: false=exact only, true=wildcard+exact
- Reconciliation integration: HAProxy config from services, DNS config
  from services, Central config domain injection, correct DNS target IPs
- dnsmasq: reach:internal has local=/, reach:public does not
- Services: idempotent registration, no duplicates in list

Bug fix:
- Run initial reconciliation on startup so Central's own domain (from
  config) gets HAProxy + DNS routes even with zero registered services.
  Previously, Central only got routes after the first service was
  registered, causing 503 on fresh restart.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/api/v1/helpers.go

@@ -16,9 +16,14 @@ import (
 	"github.com/wild-cloud/wild-central/internal/sse"
 )
 
+// Reconcile runs networking reconciliation immediately. Called on startup
+// and automatically whenever a service is registered/updated/deregistered.
+func (api *API) Reconcile() {
+	api.reconcileNetworking()
+}
+
 // reconcileNetworking reads all registered services and regenerates
-// dnsmasq DNS entries and HAProxy routes to match. Called automatically
-// whenever a service is registered, updated, or deregistered.
+// dnsmasq DNS entries and HAProxy routes to match.
 func (api *API) reconcileNetworking() {
 	svcs, err := api.services.List()
 	if err != nil {