feat(sites): a site somebody declared is a site the front end answers for (T43)

[haiquang9994]

T43 closes the loop between a site somebody declared and a front end that actually answers for it: a
site write renders, validates and reloads the front end, and site.start / site.stop decide whether
a site is in that set. Re-running any of it changes nothing on disk.

What the daemon now does

• Every write to a site — create, update, serving, delete — ends by regenerating the front end's
  documents. There is no separate "apply" step to forget.
• site.start and site.stop move a site between Running and Stopped; a second call is a no-op.
• mix site start / mix site stop reach both, by name or from the site's own directory.

The pieces underneath

• A swept directory holds exactly what was rendered into it. Recipe::swept() names the
  directories the generator owns; anything else in them is removed after the commit loop, so a
  deleted site's config leaves with it. Installed now carries removed alongside written,
  because a removal is not a document.
• Upstream is one value for where a pool listens, since Caddy spells a socket unix/<path> and
  nginx spells it unix:<path> — the difference belongs in the recipes, not in four call sites.
• PortAccess::bindings lifts the answer-port → bind-port table out of probe so a generator can
  hold it as a value. A bound filter renders it into templates, which is how macOS's 80→8080 map
  reaches a Caddyfile without a #[cfg] in mixengine-core.
• Two-pass generation: every service is prepared first so the upstream map is complete, then each
  front end renders every site the map can satisfy.

nginx listens on the address its row asked for

The site template renders listen <bind_addr>:<port>, not the bare port. nginx groups server
blocks by listen address first and consults server_name only inside a group, so a site left on
the wildcard is unreachable beside anything holding 127.0.0.1:<port> — the name is never looked
at. The status endpoint already honoured bind_addr; the site block was the one place that did not.
This also makes LAN sharing (T74) a change to one column rather than to the template.

Verified

Both front ends are exercised against the real packaged binary: a site is declared, generated,
validated, started, reloaded and stopped, and the front end is asked for it over HTTP. cargo fmt,
clippy -D warnings and cargo doc -D warnings are clean on all three OSes.