fix(proxy)!: internalize certificate resolver

[vishr]

What this changes

• Remove proxy.cert_resolver from onebox.run/v1 without a fallback or compatibility alias.
• Make every managed terminating TLS route reference the private letsencrypt resolver automatically.
• Keep operator-owned proxies independent: proxy.managed: false routes do not receive the Onebox resolver label.
• Define generated static configuration and router labels from one resolver constant.
• Require custom managed proxy configuration to define certificatesResolvers.letsencrypt only when the resolved project terminates TLS; passthrough-only projects remain unaffected.
• Reject a missing custom resolver with a typed, actionable error before any host command runs.
• Preserve caller deadline errors when either the SSH watcher or direct TCP deadline wins the handshake race.

Closes #126

Why this is correct

• Cross-package tests render the application runtime and default Traefik static configuration together, failing if a router references an undefined resolver.
• Generation tests cover managed termination, operator-owned proxies, passthrough, and rejection of the removed project field.
• Proxy and engine failure-path tests prove custom configuration is validated conditionally and before host mutation.
• SSH stress covers direct TCP deadlines and jumped SSH-channel deadlines; race-detector runs cover both paths.
• Frozen runtime digests, published schemas, and generated field documentation were deliberately regenerated.
• just check passes locally: module tidiness, vet, all Go tests, generated documentation verification, Astro diagnostics, and the static site build.

Breaking-change policy

No backward-compatibility path is provided. Existing authored projects containing proxy.cert_resolver are rejected and must remove it. Retained release snapshots containing that field cannot be replayed by this version, so rollback/resume/recovery across this CLI boundary is intentionally unsupported. Operators must finish or abort in-progress deploy recovery and remove the field before upgrading.

Custom managed Traefik configurations with terminating TLS must define certificatesResolvers.letsencrypt at upgrade time. Onebox does not retain old resolver aliases or provide a two-phase resolver-name migration. Operator-owned proxies and manually supplied certificates remain outside this contract.

Effect on the safety envelope

Resolver selection moves from authored configuration into managed behavior. Managed terminating routes request certificates automatically from the resolver in the Onebox-managed proxy configuration. The SSH follow-up changes only error classification at an existing timeout boundary: caller deadlines remain context.DeadlineExceeded, while the internal fallback reports the bounded-handshake error.

Checklist

• just check passes locally.
• Tests cover the new behavior, including failure paths and the operator-owned boundary.
• Direct and jumped SSH deadline races have stress and race-detector coverage.
• Generated documentation is current (just check verifies this).
• I have accepted the CLA, or will when the bot asks on my first pull request.