feat: service exec console

POST /services/:id/exec runs a one-off sh -c command inside the
service's container via ExecRun (30s ceiling, 64KB output cap), with
the standard service→project ownership check. Console section on the
service detail page submits commands and renders captured output with
exit codes.

Verified live: real exec output, stderr + exit code propagation, 404 on
foreign service, 401 unauthenticated, 400 on empty command.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ROADMAP.md

@@ -404,9 +404,11 @@ reaches the upstream container and appears in the analytics tables.
         with provider badge, VM/LXC lifecycle actions.
 - [ ] **Environments** (per §2.4): env switcher, per-env variables/domains,
       promote flow — ships with preview environments.
-- [ ] **Service exec console**: `docker exec` machinery now exists
-      (`Client.ExecRun` for cron) — expose a per-service web terminal or
-      one-off command runner on the service detail page.
+- [x] **Service exec console**: `POST /services/:id/exec` + Console section
+      on service detail — one-off `sh -c` commands via `ExecRun` (30s cap,
+      64KB output), ownership-checked, captured output + exit code per run.
+      Verified live: real container exec, stderr capture, 404 foreign
+      service, 401 unauthenticated. Interactive PTY remains out of scope.
 
 **Gate**: scaling and failover demonstrably work against a two-node lab;
 security scans produce real reports, not empty tables.