feat: service exec console

POST /services/:id/exec runs a one-off sh -c command inside the
service's container via ExecRun (30s ceiling, 64KB output cap), with
the standard service→project ownership check. Console section on the
service detail page submits commands and renders captured output with
exit codes.

Verified live: real exec output, stderr + exit code propagation, 404 on
foreign service, 401 unauthenticated, 400 on empty command.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/api/openapi.yaml

@@ -561,6 +561,57 @@ paths:
               schema:
                 $ref: '#/components/schemas/ServiceLogsResponse'
 
+  /services/{id}/exec:
+    post:
+      tags:
+        - Services
+      summary: Execute command in service container
+      description: Runs a one-off shell command via docker exec and returns captured output. 30s ceiling, 64KB output cap. For debugging only.
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: id
+          in: path
+          required: true
+          description: Service ID
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - command
+              properties:
+                command:
+                  type: string
+                  description: Shell command (executed via sh -c)
+                  maxLength: 4096
+      responses:
+        '200':
+          description: Command executed (check exit_code/error for failure)
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  output:
+                    type: string
+                  exit_code:
+                    type: integer
+                  error:
+                    type: string
+        '400':
+          description: Invalid request
+        '404':
+          description: Service not found
+        '409':
+          description: No running container for this service
+        '503':
+          description: Docker unavailable
+
   /deployments/{id}/logs:
     get:
       tags: