fix(proxy): keep deployment control off public routes

[yannickmonney]

Public /api/control requests currently reach the backend through both the explicit proxy route and the general API fallback. Refuse the root and descendant paths at the proxy. The CLI continues using its authenticated docker exec channel to the selected backend container.

Adds regression coverage to the existing Compose parity and real container smoke suites. Local verification: 123 tests / 2,400 assertions passed; a 32-case Caddy 2.11.4 loopback canary confirmed the previous routing and the corrected refusal, including encoded paths and subpath deployments. Formatting, scoped lint, shell syntax and the manual-test register pass. Independent source review passed; hosted container and required CI checks remain pending.

[yannickmonney]

This reviewed source is now included in #4565 at 7a526754c1c453e547e6ebb0234bf38c730009e3, together with the other release safety repairs. Independent composition review verified the source blobs are unchanged and the shared coverage register retains every addition.

I am marking this PR as draft to prevent a separate merge and cancelling only its superseded CI runs. The replacement must pass its own seven complete workflows; this PR's checks are retained as historical evidence. This change has not shipped. This PR will be closed as superseded after #4565 merges.

[yannickmonney]

Implemented in #4565, merged as 0ee5fd9656dc12f08976155d956ee76fe39f4ea3. The proxy change and its integration/Compose tests are included; the coverage row now lives in the per-suite settings register. Closing this superseded draft.