Add route declarations and automatic port allocation to MCP agent

Service definitions can now declare routes per component instead of
manual port mappings:

  [[components.routes]]
  name = "rest"
  port = 8443
  mode = "l4"

The agent allocates free host ports at deploy time and injects
$PORT/$PORT_<NAME> env vars into containers. Backward compatible:
components with old-style ports= work unchanged.

Changes:
- Proto: RouteSpec message, routes + env fields on ComponentSpec
- Servicedef: RouteDef parsing and validation from TOML
- Registry: component_routes table with host_port tracking
- Runtime: Env field on ContainerSpec, -e flag in BuildRunArgs
- Agent: PortAllocator (random 10000-60000, availability check),
  deploy wiring for route→port mapping and env injection

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/agent/agent.go

@@ -26,11 +26,12 @@ import (
 type Agent struct {
 	mcpv1.UnimplementedMcpAgentServiceServer
 
-	Config  *config.AgentConfig
-	DB      *sql.DB
-	Runtime runtime.Runtime
-	Monitor *monitor.Monitor
-	Logger  *slog.Logger
+	Config    *config.AgentConfig
+	DB        *sql.DB
+	Runtime   runtime.Runtime
+	Monitor   *monitor.Monitor
+	Logger    *slog.Logger
+	PortAlloc *PortAllocator
 }
 
 // Run starts the agent: opens the database, sets up the gRPC server with
@@ -51,11 +52,12 @@ func Run(cfg *config.AgentConfig) error {
 	mon := monitor.New(db, rt, cfg.Monitor, cfg.Agent.NodeName, logger)
 
 	a := &Agent{
-		Config:  cfg,
-		DB:      db,
-		Runtime: rt,
-		Monitor: mon,
-		Logger:  logger,
+		Config:    cfg,
+		DB:        db,
+		Runtime:   rt,
+		Monitor:   mon,
+		Logger:    logger,
+		PortAlloc: NewPortAllocator(),
 	}
 
 	tlsCert, err := tls.LoadX509KeyPair(cfg.Server.TLSCert, cfg.Server.TLSKey)