feat: add L4 (TCP/UDP) proxy host support via caddy-l4

- New l4_proxy_hosts table and Drizzle migration (0015)
- Full CRUD model layer with validation, audit logging, and Caddy config
  generation (buildL4Servers integrating into buildCaddyDocument)
- Server actions, paginated list page, create/edit/delete dialogs
- L4 port manager sidecar (docker/l4-port-manager) that auto-recreates
  the caddy container when port mappings change via a trigger file
- Auto-detects Docker Compose project name from caddy container labels
- Supports both named-volume and bind-mount (COMPOSE_HOST_DIR) deployments
- getL4PortsStatus simplified: status file is sole source of truth,
  trigger files deleted after processing to prevent stuck 'Waiting' banner
- Navigation entry added (CableIcon)
- Tests: unit (entrypoint.sh invariants + validation), integration (ports
  lifecycle + caddy config), E2E (CRUD + functional routing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

drizzle/0015_l4_proxy_hosts.sql

@@ -0,0 +1,17 @@
+CREATE TABLE `l4_proxy_hosts` (
+  `id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+  `name` text NOT NULL,
+  `protocol` text NOT NULL,
+  `listen_address` text NOT NULL,
+  `upstreams` text NOT NULL,
+  `matcher_type` text NOT NULL DEFAULT 'none',
+  `matcher_value` text,
+  `tls_termination` integer NOT NULL DEFAULT false,
+  `proxy_protocol_version` text,
+  `proxy_protocol_receive` integer NOT NULL DEFAULT false,
+  `owner_user_id` integer REFERENCES `users`(`id`) ON DELETE SET NULL,
+  `meta` text,
+  `enabled` integer NOT NULL DEFAULT true,
+  `created_at` text NOT NULL,
+  `updated_at` text NOT NULL
+);

drizzle/meta/_journal.json

@@ -106,6 +106,13 @@
       "when": 1772806000000,
       "tag": "0014_waf_blocked",
       "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "6",
+      "when": 1774300000000,
+      "tag": "0015_l4_proxy_hosts",
+      "breakpoints": true
     }
   ]
 }