feat: add L4 (TCP/UDP) proxy host support via caddy-l4

- New l4_proxy_hosts table and Drizzle migration (0015)
- Full CRUD model layer with validation, audit logging, and Caddy config
  generation (buildL4Servers integrating into buildCaddyDocument)
- Server actions, paginated list page, create/edit/delete dialogs
- L4 port manager sidecar (docker/l4-port-manager) that auto-recreates
  the caddy container when port mappings change via a trigger file
- Auto-detects Docker Compose project name from caddy container labels
- Supports both named-volume and bind-mount (COMPOSE_HOST_DIR) deployments
- getL4PortsStatus simplified: status file is sole source of truth,
  trigger files deleted after processing to prevent stuck 'Waiting' banner
- Navigation entry added (CableIcon)
- Tests: unit (entrypoint.sh invariants + validation), integration (ports
  lifecycle + caddy config), E2E (CRUD + functional routing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -89,6 +89,10 @@ services:
       - "80:80/udp"
       - "443:443"
       - "443:443/udp"
+      # L4 (TCP/UDP) proxy ports — expose as needed for L4 proxy hosts, e.g.:
+      # - "5432:5432"     # PostgreSQL
+      # - "3306:3306"     # MySQL
+      # - "6379:6379"     # Redis
       # Admin API (port 2019) is only exposed on internal network for security
       # Web UI accesses via http://caddy:2019 internally
       # Uncomment the line below to expose metrics externally for Grafana/Prometheus
@@ -110,6 +114,27 @@ services:
       retries: 3
       start_period: 10s
 
+  # L4 Port Manager sidecar — automatically recreates the caddy container
+  # when L4 proxy host ports change.
+  # Requires Docker socket access (read-only) to recreate the caddy container.
+  l4-port-manager:
+    container_name: caddy-proxy-manager-l4-ports
+    build:
+      context: .
+      dockerfile: docker/l4-port-manager/Dockerfile
+    restart: unless-stopped
+    environment:
+      DATA_DIR: /data
+      COMPOSE_DIR: /compose
+      POLL_INTERVAL: "${L4_PORT_MANAGER_POLL_INTERVAL:-2}"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - caddy-manager-data:/data
+      - .:/compose:ro
+    depends_on:
+      caddy:
+        condition: service_healthy
+
   geoipupdate:
     container_name: geoipupdate-${HOSTNAME}
     image: ghcr.io/maxmind/geoipupdate