feat: provide default application access data plane

[bugkeep]

Summary

• gate the built-in Traefik ingress controller and bare-metal ServiceLB through explicit configuration
• reconcile only CasOS-owned ingress resources and opted-in LoadBalancer Services
• publish ready worker addresses and show reachable Service and Ingress URLs in the UI

Validation

• go test ./server ./controllers -count=1
• fork CI is the release gate before the upstream PR is reopened
• one functional commit and no Go test files

Fix: casosorg#101