feat: capture managed config snapshots on deploy and restore on rollback (#32)

[fanboykun]

Added

• Config snapshot on deploy — after writing release config files and before starting services, all managed config (env files, app-dir config files, release-dir config files) is captured into releases//.watcher-snapshot/ as mirrored files, namespaced per service. Closes Write config snapshot on successful deploy #34
• Snapshot restoration on rollback — rollback reads the target version's .watcher-snapshot/ and restores all files to their actual target paths before re-registering and starting services. If no snapshot exists, rollback proceeds with a warning (same behavior as before). Closes Restore config snapshot during rollback #36
• Startup backfill — on agent boot, all existing release dirs without a snapshot receive a backfilled snapshot using current DB config as an approximation. Logged as backfilled. Closes Backfill config snapshots for pre-existing release dirs at agent startup #35
• has_snapshot API field — GET /api/watchers/:id/versions response now includes has_snapshot: true/false per version entry. Closes Surface HasSnapshot flag in ListAvailableVersions API response #37
• Dashboard indicator — versions tab shows a blue "Snapshot" badge next to versions that have a config snapshot on disk. Closes Show snapshot indicator on versions tab in dashboard #38
• EnvContent in runtime config — ServiceConfig now carries EnvContent from the DB, making it available to the deploy pipeline. Closes Map EnvContent into ServiceConfig (prerequisite for config snapshot) #33
• Domain glossary (CONTEXT.md) and ADR (docs/adr/0001-config-snapshot-layout.md) documenting the snapshot layout decisions.

Fixed

• Rollback no longer runs the old binary against potentially drifted config — env files, app-dir config files, and release-dir config files are all restored to their deploy-time state. Closes Config snapshot feature #32