Implement Plan 04 limen side Service Route domain and proxy control plane

[PianoNic]

Summary

• Adds Service and PublicRoute domain entities with EF configurations and migration ServicesAndRoutes
• New commands CreateServiceCommand and AddRouteCommand; new queries ListServicesQuery and ListRoutesQuery; proxy contracts (ProxyMessageTypes, RouteSpec, ApplyRouteSet, ProxyAuth, ProxyAuthResponse) in Limen.Contracts
• IProxyConnectionRegistry / ProxyConnectionRegistry (mirrors agent registry); ProxyConfigPusher builds RouteSpec list from DB joins (Services × Agents × WireGuardPeers) and pushes over WS; WebSocket endpoint at /api/proxies/ws authenticates Ostiarius by proxy-role node id + agent secret then pushes the initial route set; REST endpoints /api/services and /api/routes; Services and Routes pages added to the Angular shell with spartan/helm cards and nav links

Test plan

• dotnet build — 0 errors, 0 new warnings (2 pre-existing MSB3277 in test project only)
• dotnet test — 9/9 passing
• Angular ng build — lazy chunks for services and routes present; no compile errors
• GET /api/services and GET /api/routes return 200 with empty arrays after migration
• POST /api/services creates a service; POST /api/routes creates a route and attempts pusher
• WebSocket to /api/proxies/ws with invalid secret returns ProxyAuthResponse(Ok=false) and closes

Closes #21