feat(services): config schemas for the rest of the registry + textarea base64 transport

- Declarative config_schema on RDP, Telnet, MySQL, Redis, SMTP, SMTP_Relay
  matching the keys each service already reads at compose time.
- TODO marker on the 19 services that accept service_cfg but never read it,
  so future contributors know where to plug schemas in.
- Wizard base64-wraps all textarea values at INI emit (DeckyFleet
  buildIni); validate_cfg detects the b64: sentinel and decodes back to
  UTF-8. Plain raw strings still pass through for direct API submitters.
- HTTPS image entrypoint accepts PEM content or path in TLS_CERT/TLS_KEY:
  detects a BEGIN header, writes content to /opt/tls/, and re-exports
  the on-disk path so server.py keeps reading paths.
- Tests cover schema/compose alignment for each new service plus
  textarea base64 round-trip (incl. UTF-8) and HTTPS PEM end-to-end.

decnet/templates/https/entrypoint.sh

@@ -2,12 +2,28 @@
 set -e
 
 TLS_DIR="/opt/tls"
-CERT="${TLS_CERT:-$TLS_DIR/cert.pem}"
-KEY="${TLS_KEY:-$TLS_DIR/key.pem}"
+mkdir -p "$TLS_DIR"
+
+# TLS_CERT/TLS_KEY may arrive as either a host-side path OR raw PEM
+# content (the wizard ships PEM textareas as decoded strings). Detect by
+# looking for a PEM header; if present, write to disk and rebind the var
+# to the on-disk path.
+if [ -n "$TLS_CERT" ] && printf '%s' "$TLS_CERT" | grep -q 'BEGIN '; then
+    printf '%s' "$TLS_CERT" > "$TLS_DIR/cert.pem"
+    CERT="$TLS_DIR/cert.pem"
+else
+    CERT="${TLS_CERT:-$TLS_DIR/cert.pem}"
+fi
+if [ -n "$TLS_KEY" ] && printf '%s' "$TLS_KEY" | grep -q 'BEGIN '; then
+    printf '%s' "$TLS_KEY" > "$TLS_DIR/key.pem"
+    chmod 600 "$TLS_DIR/key.pem"
+    KEY="$TLS_DIR/key.pem"
+else
+    KEY="${TLS_KEY:-$TLS_DIR/key.pem}"
+fi
 
 # Generate a self-signed certificate if none exists
 if [ ! -f "$CERT" ] || [ ! -f "$KEY" ]; then
-    mkdir -p "$TLS_DIR"
     CN="${TLS_CN:-${NODE_NAME:-localhost}}"
     openssl req -x509 -newkey rsa:2048 -nodes \
         -keyout "$KEY" -out "$CERT" \
@@ -15,4 +31,8 @@ if [ ! -f "$CERT" ] || [ ! -f "$KEY" ]; then
         2>/dev/null
 fi
 
+# server.py reads TLS_CERT/TLS_KEY as filesystem paths.
+export TLS_CERT="$CERT"
+export TLS_KEY="$KEY"
+
 exec python3 /opt/server.py