feat(app): interactive system map (/map)

A spatial control surface for the whole node. Tools, jobs, services, and
frontends sit in lanes with program-source grips; edges show requires
(dependency), same-program siblings, and exposure to LAN/Internet targets.

Direct manipulation, each backed by the existing config PUT + apply:
- drag a node to LAN/Internet to set reach (internal/public)
- delete an exposure line or a node (with confirm) to unexpose/remove
- right-click or the per-node ⋯ menu: open, restart, expose, delete
- click the source grip to open the backing program

Nodes are draggable with Shift-/toggle box-select; layout persists to
localStorage with a reset control. Adds useSetReach/useDeleteDeployment
hooks, the @xyflow/react dep, and the nav entry + route.

app/src/components/Layout.tsx

@@ -12,6 +12,7 @@ import {
   Package,
   Server,
   Share2,
+  Map as MapIcon,
   Network,
   Wrench,
   X,
@@ -40,6 +41,7 @@ const NAV: (NavLeaf | NavGroup)[] = [
   },
   { to: "/programs", label: "Programs", icon: Package },
   { to: "/graph", label: "Graph", icon: Network },
+  { to: "/map", label: "System Map", icon: MapIcon },
   { to: "/mesh", label: "Mesh", icon: Share2 },
 ]