feat(services): initial config on ADD SERVICE — schema modal in DeckyCard, MazeNET drag, and Inspector

- DeckyServiceAddRequest gains an optional `config: dict` field, validated
  against the service's config_schema before any state mutation (400 on
  bad type, no half-written rows).
- Engine: add_service threads `config` into _add_topology_service /
  _add_fleet_service, persisting validated cfg to decky_config.service_config
  BEFORE compose regen so the first `up -d --build` materialises the env on
  the new container. No follow-up apply needed.
- Frontend: shared AddServiceConfigModal — same wizard accordion shape, used by:
    * DeckyCard's ADD SERVICE picker (Fleet & MazeNET inspectors via shared component)
    * MazeNET Inspector's ADD SERVICE picker
    * MazeNET palette drag-drop onto a deployed decky
  Empty-schema services short-circuit to a one-click add (no modal flash).
  Operator can cancel; errors surface in the modal.
- Tests: add_service config plumbing — persist, drop unknown keys, 400-equivalent
  on bad types, back-compat empty-config.
- Drive-by: fix stale repo-method names in test_services_live.py
  (create_topology_decky → add_topology_decky, get_topology_decky → list+pick helper,
  service.added → service_added topic).

decnet/engine/services_live.py

@@ -166,6 +166,7 @@ async def _add_topology_service(
     topology_id: str,
     decky_name: str,
     service_name: str,
+    initial_config: dict | None = None,
 ) -> list[str]:
     decky = await _topology_decky(repo, topology_id, decky_name)
     services: list[str] = list(decky.get("services") or [])
@@ -174,7 +175,17 @@ async def _add_topology_service(
             f"service {service_name!r} already on decky {decky_name!r}"
         )
     services.append(service_name)
-    await repo.update_topology_decky(decky["uuid"], {"services": services})
+    update: dict[str, Any] = {"services": services}
+    # If the caller supplied initial config, fold it into decky_config
+    # BEFORE compose regen so the first ``up`` materialises the env on
+    # the new container — no follow-up apply needed.
+    if initial_config:
+        cfg_blob = dict(decky.get("decky_config") or {})
+        sc = dict(cfg_blob.get("service_config") or {})
+        sc[service_name] = initial_config
+        cfg_blob["service_config"] = sc
+        update["decky_config"] = cfg_blob
+    await repo.update_topology_decky(decky["uuid"], update)
 
     compose_path = await _rerender_topology_compose(repo, topology_id)
     target = f"{decky_name}-{service_name}"
@@ -260,7 +271,10 @@ async def _persist_fleet_change(
 
 
 async def _add_fleet_service(
-    repo: BaseRepository, decky_name: str, service_name: str,
+    repo: BaseRepository,
+    decky_name: str,
+    service_name: str,
+    initial_config: dict | None = None,
 ) -> list[str]:
     config, compose_path = _fleet_state_or_raise()
     decky = _fleet_find_decky(config, decky_name)
@@ -270,6 +284,12 @@ async def _add_fleet_service(
             f"service {service_name!r} already on decky {decky_name!r}"
         )
     services.append(service_name)
+    if initial_config:
+        # Same path as _update_fleet_service_config: stash the validated
+        # cfg on the decky model so the compose write picks it up.
+        sc = dict(getattr(decky, "service_config", None) or {})
+        sc[service_name] = initial_config
+        decky.service_config = sc
     await _persist_fleet_change(repo, decky, services, compose_path)
     target = f"{decky_name}-{service_name}"
     await anyio.to_thread.run_sync(
@@ -313,17 +333,24 @@ async def add_service(
     decky_name: str,
     service_name: str,
     topology_id: Optional[str] = None,
+    config: dict | None = None,
 ) -> list[str]:
     """Add *service_name* to a deployed decky.
 
     Validates the service registry (rejects unknown / fleet_singleton
-    names), persists the change, regenerates the compose file, runs
+    names) and the optional ``config`` against the service's schema,
+    persists the change, regenerates the compose file, runs
     ``up -d --no-deps --build <decky>-<service>`` in a worker thread,
     and publishes ``decky.<name>.service.added`` on the bus.
 
+    ``config`` is the same dict shape PUT/POST .../config accepts; it's
+    coerced via ``BaseService.validate_cfg`` before any state write so
+    a 400-class failure leaves zero side-effects.
+
     Returns the post-mutation services list.
     """
-    _validate_service_for_per_decky(service_name)
+    svc = _validate_service_for_per_decky(service_name)
+    initial_config = svc.validate_cfg(config) if config else {}
     if decky_kind == "topology":
         if not topology_id:
             raise ServiceMutationError(
@@ -331,9 +358,13 @@ async def add_service(
             )
         services = await _add_topology_service(
             repo, topology_id, decky_name, service_name,
+            initial_config=initial_config,
         )
     elif decky_kind == "fleet":
-        services = await _add_fleet_service(repo, decky_name, service_name)
+        services = await _add_fleet_service(
+            repo, decky_name, service_name,
+            initial_config=initial_config,
+        )
     else:  # pragma: no cover — Literal narrows
         raise ServiceMutationError(f"unknown decky_kind {decky_kind!r}")
 

decnet/web/db/models/decky.py

@@ -51,8 +51,14 @@ class DeckyServiceAddRequest(BaseModel):
     and must NOT be ``fleet_singleton`` — those run once fleet-wide,
     not per-decky.  Validation happens server-side in the engine layer
     and surfaces as 422.
+
+    ``config`` carries optional initial per-service config (same shape as
+    DeckyServiceConfigRequest.config) so the freshly-added container
+    comes up with the operator's env from the start, no follow-up Apply
+    needed.  Empty dict = build with defaults.
     """
     name: str = PydanticField(..., min_length=1)
+    config: dict[str, Any] = PydanticField(default_factory=dict)
 
 
 class DeckyServicesResponse(BaseModel):

decnet/web/router/deckies/api_services.py

@@ -61,7 +61,7 @@ def _map_mutation_error(exc: ServiceMutationError) -> HTTPException:
     "/deckies/{decky_name}/services",
     response_model=DeckyServicesResponse,
     responses={
-        400: {"description": "Malformed request body"},
+        400: {"description": "Malformed request body or initial config rejected by service schema"},
         401: {"description": "Could not validate credentials"},
         403: {"description": "Insufficient permissions"},
         404: {"description": "Decky not found"},
@@ -78,7 +78,10 @@ async def api_fleet_add_service(
         services = await add_service(
             repo, decky_kind="fleet",
             decky_name=decky_name, service_name=req.name,
+            config=req.config,
         )
+    except ConfigValidationError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
     except ServiceMutationError as exc:
         raise _map_mutation_error(exc) from exc
     return DeckyServicesResponse(decky_name=decky_name, services=services)
@@ -197,7 +200,7 @@ async def api_fleet_remove_service(
     "/{topology_id}/deckies/{decky_name}/services",
     response_model=DeckyServicesResponse,
     responses={
-        400: {"description": "Malformed request body"},
+        400: {"description": "Malformed request body or initial config rejected by service schema"},
         401: {"description": "Could not validate credentials"},
         403: {"description": "Insufficient permissions"},
         404: {"description": "Topology or decky not found"},
@@ -215,7 +218,10 @@ async def api_topology_add_service(
         services = await add_service(
             repo, decky_kind="topology", topology_id=topology_id,
             decky_name=decky_name, service_name=req.name,
+            config=req.config,
         )
+    except ConfigValidationError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
     except ServiceMutationError as exc:
         raise _map_mutation_error(exc) from exc
     return DeckyServicesResponse(