fix: HA checks resolve service targets over project network; persist checks

- Health checks for local services dialed 127.0.0.1 from inside the backend
  container — the host's published port is unreachable there. Service-bound
  checks now resolve the service's DNS name on its project network (backend
  joins on demand), falling back to the service's stored port. A resolver
  failure surfaces as TARGET_UNRESOLVED instead of a fake loopback probe.
- Checks lived only in memory: a backend restart silently deleted every
  configured health check. ha_health_checks table + write-through on
  add/update/tick and hydrate-on-boot, matching the scaling-policy pattern.
- sqlc schema.sql gained the runtime columns added by later migrations —
  the stale snapshot already caused one silently-dropped-column bug.
- OpenAPI: runtime response now documents ports and health fields; types
  regenerated.
- Buttons no longer wrap ("+ new project" rendered on two lines).

Verified live: service check probes whoami-web:80 via DNS → healthy;
check survives a backend restart and rehydrates.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/api/openapi.yaml

@@ -458,6 +458,16 @@ paths:
                         type: array
                         items:
                           type: string
+                        description: Reachable service URLs; rewritten to the request Host for remote clients. Null/empty when nothing is published.
+                      ports:
+                        type: array
+                        items:
+                          type: integer
+                        description: Host ports actually bound for replica 0+; persisted on the service so restarts reuse the same public port. Null/empty when nothing is published.
+                      health:
+                        type: string
+                        enum: [healthy, unhealthy, unreachable]
+                        description: Result of the backend's HTTP probe of the service on its project network. Omitted when the service declares no healthcheck path.
                       containers:
                         type: array
                         items: