feat: Move cluster services to wild-directory as unified packages

Convert all 15 cluster services from embedded API format to
wild-directory packages using the unified manifest format:
- metallb, traefik, cert-manager, longhorn, snapshot-controller
- nfs, smtp, coredns, node-feature-discovery, nvidia-device-plugin
- externaldns, docker-registry, headlamp, crowdsec, utils

Changes:
- wild-manifest.yaml → manifest.yaml with is, defaultConfig, requires
- Eliminated configReferences and serviceConfig fields
- Flattened kustomize.template/ to package root
- Template vars use flat defaultConfig keys
- install.sh paths updated for apps/ layout
- Updated 9 app manifests: cloud.smtp.* → apps.smtp.* with requires
- Removed dead install: true field from 6 app manifests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

traefik/install.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+set -e
+set -o pipefail
+
+if [ -z "${WILD_INSTANCE}" ]; then
+    echo "ERROR: WILD_INSTANCE is not set"
+    exit 1
+fi
+
+if [ -z "${WILD_API_DATA_DIR}" ]; then
+    echo "ERROR: WILD_API_DATA_DIR is not set"
+    exit 1
+fi
+
+if [ -z "${KUBECONFIG}" ]; then
+    echo "ERROR: KUBECONFIG is not set"
+    exit 1
+fi
+
+INSTANCE_DIR="${WILD_API_DATA_DIR}/instances/${WILD_INSTANCE}"
+TRAEFIK_DIR="${INSTANCE_DIR}/apps/traefik"
+
+echo "=== Setting up Traefik Ingress Controller ==="
+echo ""
+
+echo "Verifying MetalLB is ready (required for Traefik LoadBalancer service)..."
+kubectl wait --for=condition=Ready pod -l component=controller -n metallb-system --timeout=60s 2>/dev/null || {
+    echo "MetalLB controller not ready, but continuing with Traefik installation"
+    echo "Note: Traefik LoadBalancer service may not get external IP without MetalLB"
+}
+
+echo "Installing Gateway API CRDs..."
+kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml
+
+echo "Installing Traefik CRDs..."
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.4/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
+
+echo "Waiting for CRDs to be established..."
+kubectl wait --for condition=established crd/gateways.gateway.networking.k8s.io --timeout=60s
+kubectl wait --for condition=established crd/gatewayclasses.gateway.networking.k8s.io --timeout=60s
+kubectl wait --for condition=established crd/ingressroutes.traefik.io --timeout=60s
+kubectl wait --for condition=established crd/middlewares.traefik.io --timeout=60s
+
+echo "Using pre-compiled Traefik templates..."
+if [ ! -f "${TRAEFIK_DIR}/kustomization.yaml" ]; then
+    echo "ERROR: Compiled templates not found at ${TRAEFIK_DIR}"
+    echo "Templates should be compiled before deployment."
+    exit 1
+fi
+
+echo "Deploying Traefik..."
+kubectl apply -k ${TRAEFIK_DIR}/
+
+echo "Waiting for Traefik to be ready..."
+kubectl wait --for=condition=Available deployment/traefik -n traefik --timeout=120s
+
+echo ""
+echo "Traefik installed successfully"
+echo ""
+echo "To verify the installation:"
+echo "  kubectl get pods -n traefik"
+echo "  kubectl get svc -n traefik"
+echo ""