feat: Move cluster services to wild-directory as unified packages

Convert all 15 cluster services from embedded API format to
wild-directory packages using the unified manifest format:
- metallb, traefik, cert-manager, longhorn, snapshot-controller
- nfs, smtp, coredns, node-feature-discovery, nvidia-device-plugin
- externaldns, docker-registry, headlamp, crowdsec, utils

Changes:
- wild-manifest.yaml → manifest.yaml with is, defaultConfig, requires
- Eliminated configReferences and serviceConfig fields
- Flattened kustomize.template/ to package root
- Template vars use flat defaultConfig keys
- install.sh paths updated for apps/ layout
- Updated 9 app manifests: cloud.smtp.* → apps.smtp.* with requires
- Removed dead install: true field from 6 app manifests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

headlamp/install.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+set -e
+set -o pipefail
+
+if [ -z "${WILD_INSTANCE}" ]; then
+    echo "ERROR: WILD_INSTANCE is not set"
+    exit 1
+fi
+
+if [ -z "${WILD_API_DATA_DIR}" ]; then
+    echo "ERROR: WILD_API_DATA_DIR is not set"
+    exit 1
+fi
+
+if [ -z "${KUBECONFIG}" ]; then
+    echo "ERROR: KUBECONFIG is not set"
+    exit 1
+fi
+
+INSTANCE_DIR="${WILD_API_DATA_DIR}/instances/${WILD_INSTANCE}"
+HEADLAMP_DIR="${INSTANCE_DIR}/apps/headlamp"
+
+echo "=== Setting up Headlamp ==="
+echo ""
+
+echo "Using pre-compiled Headlamp templates..."
+if [ ! -f "${HEADLAMP_DIR}/kustomization.yaml" ]; then
+    echo "ERROR: Compiled templates not found at ${HEADLAMP_DIR}"
+    echo "Templates should be compiled before deployment."
+    exit 1
+fi
+
+echo "Waiting for cert-manager certificates to be ready..."
+kubectl wait --for=condition=Ready certificate wildcard-internal-wild-cloud -n cert-manager --timeout=300s || echo "Warning: Internal wildcard certificate not ready yet"
+
+NAMESPACE="headlamp"
+
+echo "Copying cert-manager secrets to headlamp namespace..."
+kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -
+
+if kubectl get secret wildcard-internal-wild-cloud-tls -n cert-manager >/dev/null 2>&1; then
+    kubectl get secret wildcard-internal-wild-cloud-tls -n cert-manager -o yaml | \
+        sed "s/namespace: cert-manager/namespace: ${NAMESPACE}/" | \
+        kubectl apply -f -
+else
+    echo "Warning: wildcard-internal-wild-cloud-tls secret not yet available"
+fi
+
+echo "Deploying Headlamp..."
+kubectl apply -k "${HEADLAMP_DIR}/"
+
+echo "Waiting for Headlamp to be ready..."
+kubectl rollout status deployment/headlamp -n ${NAMESPACE} --timeout=120s
+
+echo ""
+echo "Headlamp installed successfully"
+echo ""
+if [ -n "${INTERNAL_DOMAIN}" ]; then
+    echo "Access Headlamp at: https://headlamp.${INTERNAL_DOMAIN}"
+else
+    echo "Access Headlamp via the configured internal domain"
+fi
+echo ""