feat: service exec console

POST /services/:id/exec runs a one-off sh -c command inside the
service's container via ExecRun (30s ceiling, 64KB output cap), with
the standard service→project ownership check. Console section on the
service detail page submits commands and renders captured output with
exit codes.

Verified live: real exec output, stderr + exit code propagation, 404 on
foreign service, 401 unauthenticated, 400 on empty command.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/frontend/src/lib/api-client.ts

@@ -1658,3 +1658,12 @@ export async function updateVulnerability(id: string, status: 'open' | 'resolved
 export async function getSecurityMetrics(projectId: string): Promise<SecurityMetrics> {
   return requestJson<SecurityMetrics>(`/projects/${encodeURIComponent(projectId)}/security/metrics`);
 }
+
+export type ExecResult = { output?: string; exit_code?: number; error?: string };
+
+export async function execInService(serviceId: string, command: string): Promise<ExecResult> {
+  return requestJson<ExecResult>(`/services/${encodeURIComponent(serviceId)}/exec`, {
+    method: 'POST',
+    body: JSON.stringify({ command }),
+  });
+}