Phase 0: expose service rollout limits

[kacy]

Summary

• add compile-time service rollout limits to GET /v1/status?mode=service_rollout
• expose DNS registry, DNS BPF, load balancer, conntrack, and recent event ceilings
• extend the existing route test to assert those limits are present

Verification

• zig fmt on touched files
• zig build test -- --test-filter "route handles /v1/status?mode=service_rollout GET" timed out after 30 seconds without emitted failures