feat: real service runtime — private networks, replicas, lifecycle, rollback

Services now reconcile into actual Docker containers instead of
bookkeeping rows:

- Per-project bridge network with service-name DNS aliases and
  ${{service.KEY}} env expansion (HOST/PORT builtins)
- Replicas, published ports, Traefik domain routing, health checks,
  restart policies persisted on the service spec; spec-hash drift
  recreates containers on redeploy
- Lifecycle API: start/stop/restart/redeploy, live runtime state,
  real image rollback (replaces the fake sleep)
- Manual scale and PUT replicas reconcile live containers; service
  and project delete remove their containers and the project network
- Canvas: real URLs, replica badges, env filter, right-click
  deploy/restart/stop/delete menu, empty state
- Service detail: real lifecycle buttons, live replica/URL strip,
  Networking editor, ${{ }} variable helper
- Fix prebuilt-image pulls racing the tag (drain the pull stream)

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/api/settings.go

@@ -3,7 +3,6 @@ package api
 import (
 	"context"
 	"database/sql"
-	"io"
 	"log"
 	"net/http"
 	"os"
@@ -241,10 +240,7 @@ func applyCloudflaredTunnel(client *docker.Client, token string) {
 		return
 	}
 
-	if reader, err := client.PullImage(ctx, cloudflaredImage, registry.AuthConfig{}); err == nil {
-		_, _ = io.Copy(io.Discard, reader)
-		_ = reader.Close()
-	} else {
+	if err := client.PullImageWait(ctx, cloudflaredImage, registry.AuthConfig{}); err != nil {
 		log.Printf("Failed to pull %s: %v", cloudflaredImage, err)
 	}