feat(services): multi-domain, DNS check, maintenance + basic-auth gates (C2)

service_domains table holds the full hostname set; services.domain stays
the derived default and is synced on every domain write. Runtime spec
carries all domains into a multi-Host Traefik rule plus access gates.

- GET|POST /services/:id/domains, DELETE + POST /:domain_id/default
- GET /services/:id/domains/check — DNS preflight vs public_ip/base_url
  (ok | wrong-target | pending), stamps last_checked_at
- maintenance_mode → Traefik redirectregex to /api/v1/maintenance
  (base_url/BASE_URL setting; falls back to noop@internal offline)
- basic_auth [{username,password}] → bcrypt htpasswd on the label;
  responses return usernames only
- First domain auto-defaults; domain="" via PUT clears all domains
- CLI: services domains list|add|remove|default|check, update
  --maintenance/--basic-auth; MCP: 5 domain tools + update args
- Settings UI: Domains card (CRUD + DNS check badges) + Access card
- Fixes latent C1 bug: PUT without volumes 500'd — nil []byte sent as
  bytea, not NULL; COALESCE needs untyped nil + ::jsonb cast

Verified live: domain CRUD + default sync, pending/wrong-target checks,
bcrypt htpasswd and both middlewares on the deployed container's labels.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/sqlc/schema.sql

@@ -59,7 +59,21 @@ CREATE TABLE services (
     healthcheck_path VARCHAR(255) NOT NULL DEFAULT '',
     restart_policy VARCHAR(50) NOT NULL DEFAULT 'unless-stopped',
     published_port INTEGER NOT NULL DEFAULT 0,
-    volumes JSONB NOT NULL DEFAULT '[]'::jsonb
+    volumes JSONB NOT NULL DEFAULT '[]'::jsonb,
+    maintenance_mode BOOLEAN NOT NULL DEFAULT false,
+    basic_auth_users TEXT NOT NULL DEFAULT ''
+);
+
+CREATE TABLE service_domains (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    service_id UUID NOT NULL REFERENCES services(id) ON DELETE CASCADE,
+    domain VARCHAR(255) NOT NULL,
+    is_default BOOLEAN NOT NULL DEFAULT false,
+    cert_type VARCHAR(32) NOT NULL DEFAULT 'letsencrypt',
+    cert_status VARCHAR(32) NOT NULL DEFAULT 'pending',
+    last_checked_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (service_id, domain)
 );
 
 CREATE TABLE deployments (