feat(service): variables editor with masked-secret preservation

PUT /services/{id}/variables replaced every row, and GET masks secrets as
******** — echoing the fetched list back would have overwritten real
secrets with asterisks. The backend now keeps the stored value when a
submitted secret still carries the mask.

Service detail gains a Variables section: add/edit/remove rows, secret
toggle, bulk .env paste (comments, export prefix, quoted values), and
inline validation for empty/invalid/duplicate keys. Parser and validator
live in variable-utils.ts with unit coverage.

Generated OpenAPI types drive the new updateServiceVariables client call.
ROADMAP: Variables UX marked done; per-environment values are already
structural — each environment owns its service instances.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ROADMAP.md

@@ -219,8 +219,12 @@ pieces exist; this phase closes the gaps that block real usage.
       plan → real `POST /databases` provisioning, not a hollow service row),
       worker/cron types, and a Template entry that jumps to the catalog with
       the project preselected (`/templates?project=`).
-- [ ] **Variables UX**: secret masking, per-environment values, bulk paste
-      (`KEY=VAL` lines), validation errors inline.
+- [x] **Variables UX**: Variables section on the service detail page — add /
+      edit / remove rows, secret masking (masked `********` secrets preserved on
+      save; editing replaces), bulk `.env` paste (`KEY=VAL`, comments, `export`
+      prefix, quoted values), inline validation (required / invalid / duplicate
+      keys). Per-environment values are already covered by the schema: each
+      environment owns its service instances, and variables are per-service.
 - [ ] **Deploy lifecycle polish**: build → deploy status propagation to canvas
       node, failed-deploy surfacing with log tail link, rollback confirmation.
 - [ ] **Node/port collision handling**: two services claiming the same host