feat: add L4 (TCP/UDP) proxy host support via caddy-l4

- New l4_proxy_hosts table and Drizzle migration (0015)
- Full CRUD model layer with validation, audit logging, and Caddy config
  generation (buildL4Servers integrating into buildCaddyDocument)
- Server actions, paginated list page, create/edit/delete dialogs
- L4 port manager sidecar (docker/l4-port-manager) that auto-recreates
  the caddy container when port mappings change via a trigger file
- Auto-detects Docker Compose project name from caddy container labels
- Supports both named-volume and bind-mount (COMPOSE_HOST_DIR) deployments
- getL4PortsStatus simplified: status file is sole source of truth,
  trigger files deleted after processing to prevent stuck 'Waiting' banner
- Navigation entry added (CableIcon)
- Tests: unit (entrypoint.sh invariants + validation), integration (ports
  lifecycle + caddy config), E2E (CRUD + functional routing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/db/schema.ts

@@ -273,3 +273,21 @@ export const wafLogParseState = sqliteTable('waf_log_parse_state', {
   key: text('key').primaryKey(),
   value: text('value').notNull(),
 });
+
+export const l4ProxyHosts = sqliteTable("l4_proxy_hosts", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  name: text("name").notNull(),
+  protocol: text("protocol").notNull(),
+  listenAddress: text("listen_address").notNull(),
+  upstreams: text("upstreams").notNull(),
+  matcherType: text("matcher_type").notNull().default("none"),
+  matcherValue: text("matcher_value"),
+  tlsTermination: integer("tls_termination", { mode: "boolean" }).notNull().default(false),
+  proxyProtocolVersion: text("proxy_protocol_version"),
+  proxyProtocolReceive: integer("proxy_protocol_receive", { mode: "boolean" }).notNull().default(false),
+  ownerUserId: integer("owner_user_id").references(() => users.id, { onDelete: "set null" }),
+  meta: text("meta"),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull(),
+});