Wire services end-to-end: Caddy reload, NAT reflection, port forward

Fully wired service proxy deployment:

Backend:
- /api/services/status: full checklist (OPNsense API, SSH, NAT
  reflection, port forward 443, Caddyfile.services, service count)
- /api/services/enable-nat-reflection: enables NAT reflection on
  OPNsense via SSH config.xml edit + filter reload
- /api/services/create-port-forward: creates WAN TCP 443 → Caddy
  port forward via OPNsense NAT API, tracks rule UUID
- /api/services/deploy: writes Caddyfile.services, reloads Caddy
  (tries docker compose exec, then restart, then systemctl), checks
  NAT reflection status, verifies port forward exists

Infrastructure:
- docker-compose.yml: mount Caddyfile.services into Caddy container,
  switch-manager volume writable (for writing Caddyfile.services)
- Caddyfile.template: auto-imports /etc/caddy/Caddyfile.services

Frontend:
- Setup Checklist panel with green/red dots for each prerequisite
- Enable NAT Reflection button (one-click)
- Create Port Forward button (one-click)
- Deploy button writes Caddyfile, reloads Caddy, verifies everything
- Caddyfile preview in deploy results

https://claude.ai/code/session_01Do9bsN39MTuy2GVv7yzSrE

Caddyfile.template

@@ -9,6 +9,5 @@
     redir https://{{host}}{{uri}} permanent
 }}
 
-# Service proxies — auto-generated by switch-manager
-# To include service proxy entries, add this line (uncommented) after deployment:
-# import /etc/switch-manager/Caddyfile.services
+# Service reverse proxy entries — auto-managed by switch-manager Services tab
+import /etc/caddy/Caddyfile.services