feat(mgmt): public Management API — granted stacks manage a template's tenants

[swimmesberger]

What

Adds the public Management API (/api/mgmt/*): a token-authenticated REST surface through which a deployed stack — typically a product vendor's own central-management UI, itself running as a Watchtower stack — manages the tenants of a StackTemplate it has been granted: list, provision under a subdomain, inspect status, redeploy, stream logs, and (with the AllowDelete capability) deprovision with an opt-in volume purge.

Why

Watchtower acts as the background orchestrator for product-specific management UIs that provision customer tenants (e.g. customer4.example.com). Neither existing surface fits: the admin JSON-RPC API would hand the vendor UI operator credentials (a leaked token owns the Docker host), and the App API is self-only by design. See ADR-0009.

How

• Credential: the caller stack's existing App API token (WATCHTOWER_APP_TOKEN) — injection/rotation already solved. Authorization: a new operator-managed TemplateManagementGrant row (admin-only RPC: templates.listGrants/grantManagement/revokeManagement); the token alone grants nothing new.
• Uniform 404 for ungranted templates (never confirms existence); tenant lookups always constrained by the granted template id; Docker/log access goes through a synthesized AppApiCaller, so all compose-project scoping applies unchanged; env values, deploy output, tokens and credentials never appear in any response.
• TenantProvisioningService extracted from templates.addTenant; new TenantTeardownService — the first real teardown path (compose down → row delete → Caddy reload, 409 while a deploy is active) — also behind the new templates.removeTenant.
• SSE log streaming extracted to SseLogStreaming, shared byte-identically by /api/app/logs and the tenant logs endpoint.
• Operator UI: Management API card on the template detail page; per-tenant removal with typed-slug confirmation.
• Docs: docs/public-mgmt-api.md, ADR-0009, README pointers.

Reviewer notes

• The teardown active-deploy check is a check, not a lock; the narrow race (deploy enqueued in the instant after it passes) leaves orphaned containers, documented as accepted residual risk in ADR-0009 with the cleanup command.
• AppApiEnabled on the calling stack is the single kill switch for both public surfaces; a tenant's own flag doesn't hide it from its manager (documented).
• The two Docker-touching endpoints (GET tenant status, logs) have no happy-path tests: the Docker socket path is hard-coded, so 200-vs-503 depends on the runner having a daemon — recorded in a remark on MgmtApiTests.
• Test seams: ComposeCliService.DownProjectAsync, CaddyManager.ApplyAsync, DeployQueueService.Enqueue are now virtual and substituted assembly-wide in WatchtowerApiFactory (rationale in its comment). Teardown ordering is pinned by probes sampling DB state at call time (mutation-tested).
• rpc-schema.json diff is purely additive: the four new templates.* methods.

Verification

• dotnet build Watchtower.slnx --configuration Release — 0 warnings, 0 errors
• dotnet test — 207 (Application.Tests) + 117 (Api.Tests) passed, 0 failed
• Schema export byte-stable; npm run build (tsc + vite) clean