Support path-based HTTP routing and redirects in nullnet-proxy

[antoncxx]

nullnet-proxy could only route a Host to exactly one backend, keyed by the
Host header itself — no way to send example.com/api to one service and
example.com/grafana to another, and no way to configure a redirect beyond
the hardcoded HTTP→HTTPS 301. Kevin's ask was NGINX location-block parity:
route by path prefix to different backends, redirects included, so multiple
apps can share one Host without a separate NGINX in front of the proxy.

This adds a route table — (host, path_prefix) → target, decoupled from
service definitions — distributed to the proxy the same way certs/port-
mappings already are (WatchHttpRoutes, mirroring WatchCertificates/
WatchPortMappings: full table on subscribe, one push per config change).
A target is either an existing service name (resolved through the exact
same Proxy RPC / container-discovery / VXLAN-edge path a Host-routed
service goes through today) or a literal redirect. Within a host, the
longest matching path_prefix wins; "/" is the catch-all.

Backward compatible with no migration: every proxy-reachable http service
with no explicit [[route]] of its own gets an implicit
{host = name, path = "/"} fallback synthesized server-side, so an install
with zero [[route]] entries behaves exactly as it does today. An explicit
route for a host takes over that host's dispatch entirely — paths outside
its declared prefixes 404 instead of falling back, same as an NGINX
server{} block with no catch-all location /.

[[route]]
host = "ops.example.com"
path = "/api"
service = "api"
strip_prefix = true        # backend sees /users, not /api/users

[[route]]
host = "old.example.com"
path = "/old"
redirect_to = "/new"
redirect_status = 301      # default
preserve_path = true       # /old/x/y -> /new/x/y
preserve_query = true      # ?foo=bar carried through

strip_prefix/preserve_path/preserve_query all default to false and
are rejected on the wrong target kind (strip_prefix needs service,
preserve_path/preserve_query need redirect_to). (host, path) must be
globally unique across every stack, checked the same way
(protocol, listen_port) already is for tcp/udp — a conflict drops the
offending stacks rather than bricking the control plane, same tolerance
detect_port_conflicts already has.

Also ships an admin UI page (Routes.tsx, under a new /routes nav entry):
a table of routes with an Add/Edit modal, following the one existing
CRUD+modal precedent in this UI (Users.tsx) since everything else here is
raw-TOML editing. Saves go through GET/POST /api/routes/{stack}, which
validates a route the same way the TOML loader does and merges the result
back into the stack's TOML file via toml_edit — structural editing, so
[[services]] entries, comments, and formatting are untouched, unlike a
full-document serde round-trip.

Ingress country policy is now checked against the resolved backend rather
than the raw Host header, since path routing can send a host to a different
service than its own name.

Manually verified end-to-end (server + proxy + a real client, real backend
containers) in addition to the unit tests below — hot-reload of route
changes propagates correctly; one "not working" symptom hit along the way
turned out to be a stale proxy binary (right commit, not rebuilt), not a
code bug.

Fixes #137.