feat(services): add optional service proxies

[calvin-archastro]

Review on ArchCode

Problem and author intent

Aster advertises stable named ports for worktree services, and existing CLI consumers depend on those mappings. Inserting an external debugging or logging proxy currently requires changing the advertised port or maintaining an out-of-band launch flow.

This change lets a service declare an optional proxy target. aster services up <group> --proxy moves the underlying service to a separate upstream port, starts the proxy on the original advertised port, and preserves existing service discovery.

What changed

• Added [dev.services.<name>.proxy] with a stream target, named upstream_port, and proxy-specific environment.
• Added aster services up <group> --proxy; proxy configuration is inert without the flag.
• Kept services ports, {ports.<name>}, manifests, and browser URLs on the original advertised port.
• Rebound the underlying service {port}, ASTER_SERVICE_PORT, and self-referential port_env values to the upstream port in proxy mode.
• Added generated <service>-proxy lifecycle, daemon-mode consistency checks, service reporting, and log lookup.
• Documented proxy templates and automatic ASTER_PROXY_* environment variables.

Scope

Backend and CLI only. No frontend changes.

Risk assessment

Medium. This changes service planning and daemon launch protocol, but only when a service configures a proxy and the caller passes --proxy. Existing launches retain their prior path. The feature is covered across real process and network boundaries plus the complete Aster test suite.

User impact

Users can optionally insert targets such as platform-proxy-logger in front of a service without changing the port reported by Aster or breaking commands that discover worktree ports. Existing service configurations and commands behave unchanged.

Testing

• cargo fmt --all -- --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• RUSTDOCFLAGS="-D warnings" cargo doc --locked --no-deps --all-features
• cargo test --locked --all-targets --all-features — all tests passed
• cargo audit was unavailable in the local environment.

Canonical end-to-end proof: tests/dev_services.rs, optional_service_proxy_preserves_the_advertised_port_end_to_end. It starts a real Python HTTP service and a separate real TCP proxy, sends a client request through the advertised socket, verifies forwarding to the dynamically leased upstream socket, checks environment and published port state, reads proxy logs through the CLI, shuts down both processes, then relaunches without --proxy and verifies direct reuse of the original port.

Daemon proof: tests/dev_services.rs, daemon_rejects_reattach_with_a_different_proxy_mode. It launches a real daemon-managed proxied bundle, verifies generated service and port state, rejects a conflicting direct-mode reattach, and accepts a same-mode reattach.

Follow-ups and known issues

• No known issues.
• This PR provides the Aster primitive only; individual repositories opt services into it through their own aster.toml configuration.