feat: Add comprehensive tests + fix startup reconciliation

Tests added (13 new):
- HAProxy ACL ordering: L7 before L4 wildcard, L4 exact before L4 wildcard
- HAProxy subdomains: false=exact only, true=wildcard+exact
- Reconciliation integration: HAProxy config from services, DNS config
  from services, Central config domain injection, correct DNS target IPs
- dnsmasq: reach:internal has local=/, reach:public does not
- Services: idempotent registration, no duplicates in list

Bug fix:
- Run initial reconciliation on startup so Central's own domain (from
  config) gets HAProxy + DNS routes even with zero registered services.
  Previously, Central only got routes after the first service was
  registered, causing 503 on fresh restart.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

main.go

@@ -116,6 +116,10 @@ func main() {
 	api.StartCentralStatusBroadcaster(startTime)
 	slog.Info("central status broadcaster started")
 
+	// Run initial reconciliation so Central's own domain (from config) gets
+	// DNS + HAProxy routes even with zero registered services.
+	api.Reconcile()
+
 	api.StartDDNS(ctx)
 
 	router := mux.NewRouter()