Wire services end-to-end: Caddy reload, NAT reflection, port forward

Fully wired service proxy deployment:

Backend:
- /api/services/status: full checklist (OPNsense API, SSH, NAT
  reflection, port forward 443, Caddyfile.services, service count)
- /api/services/enable-nat-reflection: enables NAT reflection on
  OPNsense via SSH config.xml edit + filter reload
- /api/services/create-port-forward: creates WAN TCP 443 → Caddy
  port forward via OPNsense NAT API, tracks rule UUID
- /api/services/deploy: writes Caddyfile.services, reloads Caddy
  (tries docker compose exec, then restart, then systemctl), checks
  NAT reflection status, verifies port forward exists

Infrastructure:
- docker-compose.yml: mount Caddyfile.services into Caddy container,
  switch-manager volume writable (for writing Caddyfile.services)
- Caddyfile.template: auto-imports /etc/caddy/Caddyfile.services

Frontend:
- Setup Checklist panel with green/red dots for each prerequisite
- Enable NAT Reflection button (one-click)
- Create Port Forward button (one-click)
- Deploy button writes Caddyfile, reloads Caddy, verifies everything
- Caddyfile preview in deploy results

https://claude.ai/code/session_01Do9bsN39MTuy2GVv7yzSrE

docker-compose.yml

@@ -6,6 +6,7 @@ services:
       - "443:443"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - /etc/switch-manager/Caddyfile.services:/etc/caddy/Caddyfile.services:ro
       - caddy_data:/data
       - caddy_config:/config
     restart: unless-stopped
@@ -17,7 +18,7 @@ services:
     expose:
       - "8765"
     volumes:
-      - /etc/switch-manager:/etc/switch-manager:ro
+      - /etc/switch-manager:/etc/switch-manager
       - ./frontend/dist:/app/frontend/dist:ro
     restart: unless-stopped
     environment: