feat: real service runtime — private networks, replicas, lifecycle, rollback

Services now reconcile into actual Docker containers instead of
bookkeeping rows:

- Per-project bridge network with service-name DNS aliases and
  ${{service.KEY}} env expansion (HOST/PORT builtins)
- Replicas, published ports, Traefik domain routing, health checks,
  restart policies persisted on the service spec; spec-hash drift
  recreates containers on redeploy
- Lifecycle API: start/stop/restart/redeploy, live runtime state,
  real image rollback (replaces the fake sleep)
- Manual scale and PUT replicas reconcile live containers; service
  and project delete remove their containers and the project network
- Canvas: real URLs, replica badges, env filter, right-click
  deploy/restart/stop/delete menu, empty state
- Service detail: real lifecycle buttons, live replica/URL strip,
  Networking editor, ${{ }} variable helper
- Fix prebuilt-image pulls racing the tag (drain the pull stream)

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/api/projects.go

@@ -3,6 +3,8 @@ package api
 import (
 	"containr/internal/database"
 	"containr/internal/database/sqlcdb"
+	"containr/internal/deployment"
+	"context"
 	"database/sql"
 	"errors"
 	"net/http"
@@ -310,6 +312,16 @@ func handleDeleteProject(c *gin.Context) {
 		return
 	}
 
+	// Remove live containers and the project network before dropping rows.
+	// Best-effort: Docker may be unavailable; DB cleanup proceeds regardless.
+	if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+		engine := engineValue.(*deployment.DeploymentEngine)
+		ctx, cancel := context.WithTimeout(c.Request.Context(), 30*time.Second)
+		_ = engine.RemoveProjectContainers(ctx, projectID.String())
+		_ = engine.RemoveProjectNetwork(ctx, projectID.String())
+		cancel()
+	}
+
 	deletedRows, err := queries.DeleteProjectByID(c.Request.Context(), projectID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete project"})