Add L7 VIP steering control plane

[kacy]

Summary

• make the XDP port mapper VIP-aware while preserving wildcard host-port forwarding
• add an L7 steering runtime that computes VIP-to-listener mappings from canonical service state
• wire steering refresh into startup, service membership, and health transitions
• expose steering status and sync counters in rollout status and Prometheus

Validation

• zig fmt on touched files
• single-process targeted zig build test runs for:
  • previewDesiredMappings materializes unique vip port mappings
  • route handles /v1/status?mode=service_rollout GET
  • handleMetricsPrometheus exposes service rollout metrics
• final targeted runs timed out at 45s without emitted failures

Commits

• Make port mapper VIP-aware
• Add L7 steering runtime scaffold
• Wire L7 VIP steering through control plane
• Add L7 steering sync counters