feat(services): traefik routing overrides via allowlisted middleware labels (#64)

services.traefik_labels (jsonb) holds operator-defined Traefik
middlewares keyed 'middlewares.<name>.<type>[.<field>]', validated
against an allowlist at write time. edgeLabels (extracted from
createReplica) scopes each definition to the service router as
<router>-<name> and auto-attaches it to the router's middleware chain
after builtins. Router/service/provider-level keys are rejected.

Surfaces: create/update API fields, services create/update
--traefik-label (repeatable, key=value), MCP arg docs, OpenAPI +
regenerated types, service-page Access editor (Routing overrides
card + textarea).

Also marks three stale ROADMAP2 items shipped: notification producers
round-out, build-on-node (PR #60), mobile env/domains/scaling (PR #61).

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/frontend/src/generated/api-types.ts

@@ -11021,6 +11021,10 @@ export interface components {
             spread?: boolean;
             /** @description Node tags required for remote placement — auto/spread only consider agents carrying every tag; re-resolved each reconcile. Mutually exclusive with an explicit node_id pin (read-only on responses when a pin is set). */
             placement_tags?: string[];
+            /** @description Extra Traefik middlewares defined for this service's router — keys 'middlewares.<name>.<type>[.<field>]' (e.g. 'middlewares.rl.ratelimit.average'), allowlist-validated; each defined middleware attaches to the router after builtins */
+            traefik_labels?: {
+                [key: string]: string;
+            };
             /** @description Computed public URL (published port or domain) */
             public_url?: string;
             /**
@@ -11097,6 +11101,10 @@ export interface components {
             spread?: boolean;
             /** @description Restrict remote placement to agents carrying every listed tag; mutually exclusive with an explicit pin or 'local' */
             placement_tags?: string[];
+            /** @description Extra Traefik middlewares on the service router — keys 'middlewares.<name>.<type>[.<field>]'; allowlist-validated */
+            traefik_labels?: {
+                [key: string]: string;
+            };
         };
         UpdateServiceRequest: {
             /** @description Service name */
@@ -11164,6 +11172,10 @@ export interface components {
             spread?: boolean;
             /** @description Restrict remote placement to agents carrying every listed tag; [] clears. Mutually exclusive with a pin or 'local' — clear the pin first */
             placement_tags?: string[];
+            /** @description Replace the service's Traefik middleware overrides — keys 'middlewares.<name>.<type>[.<field>]'; {} clears */
+            traefik_labels?: {
+                [key: string]: string;
+            };
         };
         ServiceDomain: {
             /** Format: uuid */