feat(services): clone/move ops + owner-scoped registry credentials (C4)

Service lifecycle: POST /services/:id/clone duplicates config, volumes,
domains, access gates, builder settings, and variables (secret ciphertext
copied verbatim); POST /services/:id/move re-parents to another owned
project. Both enforce ownership, reject name conflicts, and audit.

Registries: CRUD at /registries — host-matched pull credentials for
prebuilt-image deploys, encrypted at rest via secrets pkg, never returned
(has_password flag). Empty password on update keeps the stored credential;
host normalized (scheme/case/trailing slash). Credentials thread through
BuildConfig → BuildRequest → pull auth config, used only for the pull.

Surfaces: CLI services clone|move + registries group, 7 MCP tools,
OpenAPI paths/schemas, frontend Lifecycle card (clone/move/delete) and
Settings registries section, llms.txt + CLI.md.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/guides/CLI.md

@@ -38,7 +38,9 @@ auth login|logout|status         token auth and profiles
 tokens list|create|revoke        personal access tokens
 projects list|get|create|delete
 services list|get|create|update|delete|start|stop|restart|redeploy
+services clone|move              duplicate config or re-parent a service
 services domains list|add|remove|default|check   multi-domain + DNS preflight
+registries list|add|update|remove  private-image pull credentials
 volumes list|delete              docker volume inventory + cleanup (admin)
 deploy <service-id>              trigger a deployment (--no-cache, --commit-hash, --branch)
 deployments list|get|logs|rollback|cancel
@@ -143,6 +145,30 @@ instance-level defaults used at service creation;
 `app_settings.capacity_policy=block` fails deployments whose requested
 memory exceeds node capacity (default `warn` logs only).
 
+## Clone, move, registries
+
+`services clone` duplicates config, volumes, domains, access gates,
+builder settings, and variables — ciphertext secret values are copied
+verbatim (no decrypt/re-encrypt). The clone starts stopped:
+
+```bash
+containr services clone <id> --name staging-api --project <other-project-id> --environment preview
+containr services move <id> <project-id>    # name conflicts → 409
+```
+
+Note: cloned domains are verbatim copies — the same hostname attached to
+two services makes Traefik routing ambiguous. Re-domain or undeploy one.
+
+`registries` stores private-image pull credentials, owner-scoped and
+encrypted at rest. Matched by image host on every image-sourced deploy:
+
+```bash
+containr registries add ghcr ghcr.io --username <user> --password <pat>
+containr registries add hub docker.io --username <user> --password <pw>   # Docker Hub
+containr registries update <id> --username <new-user>   # empty --password keeps stored
+containr registries remove <id>
+```
+
 ## MCP server
 
 `containr-mcp` (`go build ./cmd/mcp`) exposes the same API as MCP tools