Add Phase 6 HTTP proxy control-plane scaffolding

[kacy]

Summary

• add manifest parsing and spec support for opt-in http_proxy service config
• persist proxy policy in canonical service state and expose it through service snapshots and /v1/services
• add inert L7 proxy modules plus a control-plane runtime that materializes configured proxy routes and exposes rollout status/metrics
• sync manifest proxy config into canonical service state during local deploy bootstrap so the control plane can see it before containers start

Validation

• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "http proxy config"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "matchRoute"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "createService and getService round-trip"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "runtime bootstraps from persisted services"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "route handles GET /v1/services"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "bootstrap tracks configured proxy routes from service state"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "route handles /v1/status?mode=service_rollout GET"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "handleMetricsPrometheus exposes service rollout metrics"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "syncServiceConfig updates proxy policy without changing vip"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "syncServiceDefinitions persists http proxy config for started services"

All bounded test runs exited on timeout without emitted failures.