feat: provide default application access data plane

[bugkeep]

Summary

• install an optional built-in Traefik ingress controller and ServiceLB data plane
• keep LoadBalancer ownership explicit and reconcile per-Service proxy DaemonSets without mutating user-managed spec.externalIPs
• expose application access addresses in the API and UI, and clean up only resources owned by CasOS
• keep Traefik and ServiceLB image defaults in Go; conf/app.conf contains only ingressControllerEnabled and serviceLBEnabled

Dependency

This PR is stacked on #169. Commit order:

1. a7fa5261 - canonical image references and configurable containerd registry fallback routing
2. 37dfd349 - default application access data plane

After the dependency is merged, this PR's effective diff is only the application access data plane change.

Ownership and compatibility

• classless LoadBalancer Services and casos.io/service-lb Services are managed by default; Services with another LoadBalancerClass are left untouched
• ServiceLB does not modify user-owned Service spec or metadata in steady state; upgrades remove only legacy externalIPs previously recorded by CasOS
• casos.io/service-lb-disabled=true opts a Service out, and disabling the feature cleans only CasOS-owned proxy resources and status
• an incomplete Ingress-without-ServiceLB configuration logs a warning and disables the built-in Ingress controller instead of aborting CasOS startup

Validation

• fork feat: unify built-in image registry routing #169 and this PR passed Running Go tests, Back-end, Go-Linter, Front-end, and UI tests
• UI verification covered worker readiness plus nginx and Casdoor installation through their access URLs
• server/servicelb_test.go covers stable UID suffixes, namespace/name fallback, DNS-label boundaries, maximum length, and namespace isolation
• go test ./...
• go vet ./...
• go build ./...