feat(services): multi-domain, DNS check, maintenance + basic-auth gates (C2)

service_domains table holds the full hostname set; services.domain stays
the derived default and is synced on every domain write. Runtime spec
carries all domains into a multi-Host Traefik rule plus access gates.

- GET|POST /services/:id/domains, DELETE + POST /:domain_id/default
- GET /services/:id/domains/check — DNS preflight vs public_ip/base_url
  (ok | wrong-target | pending), stamps last_checked_at
- maintenance_mode → Traefik redirectregex to /api/v1/maintenance
  (base_url/BASE_URL setting; falls back to noop@internal offline)
- basic_auth [{username,password}] → bcrypt htpasswd on the label;
  responses return usernames only
- First domain auto-defaults; domain="" via PUT clears all domains
- CLI: services domains list|add|remove|default|check, update
  --maintenance/--basic-auth; MCP: 5 domain tools + update args
- Settings UI: Domains card (CRUD + DNS check badges) + Access card
- Fixes latent C1 bug: PUT without volumes 500'd — nil []byte sent as
  bytea, not NULL; COALESCE needs untyped nil + ::jsonb cast

Verified live: domain CRUD + default sync, pending/wrong-target checks,
bcrypt htpasswd and both middlewares on the deployed container's labels.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/deployment/engine.go

@@ -57,6 +57,11 @@ type ServiceConfig struct {
 	PublicPort int32 `json:"public_port,omitempty"`
 	// Domain is a public hostname routed to PublicPort via Traefik.
 	Domain string `json:"domain,omitempty"`
+	// Domains is the full hostname set (includes Domain when set).
+	Domains        []string `json:"domains,omitempty"`
+	Maintenance    bool     `json:"maintenance,omitempty"`
+	MaintenanceURL string   `json:"maintenance_url,omitempty"`
+	BasicAuthUsers string   `json:"basic_auth_users,omitempty"`
 	// HealthPath is an HTTP path probed on PublicPort for container health.
 	HealthPath string `json:"health_path,omitempty"`
 	// PublishedPort is the host port bound by the previous deployment; replica 0
@@ -312,21 +317,25 @@ func (de *DeploymentEngine) deployService(ctx context.Context, deployment *Deplo
 	cfg := deployment.Config
 
 	spec := RuntimeSpec{
-		ProjectID:     deployment.ProjectID,
-		ServiceID:     deployment.ServiceID,
-		Name:          cfg.Name,
-		Image:         deployment.ImageName,
-		Command:       cfg.Command,
-		Env:           cfg.Environment,
-		Replicas:      cfg.Replicas,
-		Port:          cfg.PublicPort,
-		PublishedPort: cfg.PublishedPort,
-		Domain:        cfg.Domain,
-		HealthPath:    cfg.HealthPath,
-		RestartPolicy: cfg.RestartPolicy,
-		MemoryBytes:   cfg.Resources.MemoryBytes,
-		NanoCPUs:      cfg.Resources.CPUQuota,
-		Volumes:       cfg.VolumeMounts,
+		ProjectID:      deployment.ProjectID,
+		ServiceID:      deployment.ServiceID,
+		Name:           cfg.Name,
+		Image:          deployment.ImageName,
+		Command:        cfg.Command,
+		Env:            cfg.Environment,
+		Replicas:       cfg.Replicas,
+		Port:           cfg.PublicPort,
+		PublishedPort:  cfg.PublishedPort,
+		Domain:         cfg.Domain,
+		HealthPath:     cfg.HealthPath,
+		RestartPolicy:  cfg.RestartPolicy,
+		MemoryBytes:    cfg.Resources.MemoryBytes,
+		NanoCPUs:       cfg.Resources.CPUQuota,
+		Volumes:        cfg.VolumeMounts,
+		Domains:        cfg.Domains,
+		Maintenance:    cfg.Maintenance,
+		MaintenanceURL: cfg.MaintenanceURL,
+		BasicAuthUsers: cfg.BasicAuthUsers,
 	}
 	for _, pm := range cfg.PortMappings {
 		if spec.Port == 0 {