feat: Add service registration API

Add the service registration abstraction — the key contract between
Central and its consumers (Wild Cloud, Wild Works). Services register
with Central to get DNS, gateway routing, TLS, and public exposure.

- internal/services/manager.go: CRUD for service registrations stored
  as YAML files, with reach model (off/internal/public), backend types
  (tcp-passthrough/http/static), and TLS modes
- internal/api/v1/handlers_services.go: HTTP endpoints
  POST/GET/PATCH/DELETE /api/v1/services
- Full test coverage for registration, update, deregister, validation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/services/manager_test.go

@@ -0,0 +1,161 @@
+package services
+
+import (
+	"testing"
+)
+
+func TestRegisterAndGet(t *testing.T) {
+	mgr := NewManager(t.TempDir())
+
+	svc := Service{
+		Name:   "my-api",
+		Source: "wild-works",
+		Domain: "my-api.payne.io",
+		Backend: Backend{
+			Address: "192.168.8.60:9001",
+			Type:    BackendHTTP,
+			Health:  "/health",
+		},
+		Reach: ReachInternal,
+	}
+
+	if err := mgr.Register(svc); err != nil {
+		t.Fatalf("Register failed: %v", err)
+	}
+
+	got, err := mgr.Get("my-api")
+	if err != nil {
+		t.Fatalf("Get failed: %v", err)
+	}
+
+	if got.Domain != "my-api.payne.io" {
+		t.Errorf("expected domain my-api.payne.io, got %s", got.Domain)
+	}
+	if got.Backend.Address != "192.168.8.60:9001" {
+		t.Errorf("expected backend 192.168.8.60:9001, got %s", got.Backend.Address)
+	}
+	if got.Reach != ReachInternal {
+		t.Errorf("expected reach internal, got %s", got.Reach)
+	}
+	if got.TLS != TLSTerminate {
+		t.Errorf("expected TLS terminate (default for http), got %s", got.TLS)
+	}
+}
+
+func TestRegisterTCPPassthrough(t *testing.T) {
+	mgr := NewManager(t.TempDir())
+
+	svc := Service{
+		Name:   "payne-cloud",
+		Source: "wild-cloud",
+		Domain: "cloud.payne.io",
+		Backend: Backend{
+			Address: "192.168.8.100:443",
+			Type:    BackendTCPPassthrough,
+		},
+		Reach: ReachInternal,
+	}
+
+	if err := mgr.Register(svc); err != nil {
+		t.Fatalf("Register failed: %v", err)
+	}
+
+	got, err := mgr.Get("payne-cloud")
+	if err != nil {
+		t.Fatalf("Get failed: %v", err)
+	}
+
+	if got.TLS != TLSPassthrough {
+		t.Errorf("expected TLS passthrough (default for tcp-passthrough), got %s", got.TLS)
+	}
+}
+
+func TestListServices(t *testing.T) {
+	mgr := NewManager(t.TempDir())
+
+	for _, name := range []string{"svc-a", "svc-b", "svc-c"} {
+		if err := mgr.Register(Service{
+			Name:    name,
+			Source:  "test",
+			Domain:  name + ".example.com",
+			Backend: Backend{Address: "127.0.0.1:8080", Type: BackendHTTP},
+			Reach:   ReachInternal,
+		}); err != nil {
+			t.Fatalf("Register %s failed: %v", name, err)
+		}
+	}
+
+	svcs, err := mgr.List()
+	if err != nil {
+		t.Fatalf("List failed: %v", err)
+	}
+	if len(svcs) != 3 {
+		t.Errorf("expected 3 services, got %d", len(svcs))
+	}
+}
+
+func TestDeregister(t *testing.T) {
+	mgr := NewManager(t.TempDir())
+
+	if err := mgr.Register(Service{
+		Name:    "temp",
+		Source:  "test",
+		Domain:  "temp.example.com",
+		Backend: Backend{Address: "127.0.0.1:8080", Type: BackendHTTP},
+		Reach:   ReachInternal,
+	}); err != nil {
+		t.Fatalf("Register failed: %v", err)
+	}
+
+	if err := mgr.Deregister("temp"); err != nil {
+		t.Fatalf("Deregister failed: %v", err)
+	}
+
+	if _, err := mgr.Get("temp"); err == nil {
+		t.Error("expected error after deregister, got nil")
+	}
+}
+
+func TestUpdate(t *testing.T) {
+	mgr := NewManager(t.TempDir())
+
+	if err := mgr.Register(Service{
+		Name:    "updatable",
+		Source:  "test",
+		Domain:  "updatable.example.com",
+		Backend: Backend{Address: "127.0.0.1:8080", Type: BackendHTTP},
+		Reach:   ReachInternal,
+	}); err != nil {
+		t.Fatalf("Register failed: %v", err)
+	}
+
+	if err := mgr.Update("updatable", map[string]any{
+		"reach": "public",
+	}); err != nil {
+		t.Fatalf("Update failed: %v", err)
+	}
+
+	got, _ := mgr.Get("updatable")
+	if got.Reach != ReachPublic {
+		t.Errorf("expected reach public after update, got %s", got.Reach)
+	}
+}
+
+func TestRegisterValidation(t *testing.T) {
+	mgr := NewManager(t.TempDir())
+
+	// Missing name
+	if err := mgr.Register(Service{Domain: "x.com", Backend: Backend{Address: "127.0.0.1:80"}}); err == nil {
+		t.Error("expected error for missing name")
+	}
+
+	// Missing domain
+	if err := mgr.Register(Service{Name: "x", Backend: Backend{Address: "127.0.0.1:80"}}); err == nil {
+		t.Error("expected error for missing domain")
+	}
+
+	// Missing backend
+	if err := mgr.Register(Service{Name: "x", Domain: "x.com"}); err == nil {
+		t.Error("expected error for missing backend")
+	}
+}