feat(services): initial config on ADD SERVICE — schema modal in DeckyCard, MazeNET drag, and Inspector

- DeckyServiceAddRequest gains an optional `config: dict` field, validated
  against the service's config_schema before any state mutation (400 on
  bad type, no half-written rows).
- Engine: add_service threads `config` into _add_topology_service /
  _add_fleet_service, persisting validated cfg to decky_config.service_config
  BEFORE compose regen so the first `up -d --build` materialises the env on
  the new container. No follow-up apply needed.
- Frontend: shared AddServiceConfigModal — same wizard accordion shape, used by:
    * DeckyCard's ADD SERVICE picker (Fleet & MazeNET inspectors via shared component)
    * MazeNET Inspector's ADD SERVICE picker
    * MazeNET palette drag-drop onto a deployed decky
  Empty-schema services short-circuit to a one-click add (no modal flash).
  Operator can cancel; errors surface in the modal.
- Tests: add_service config plumbing — persist, drop unknown keys, 400-equivalent
  on bad types, back-compat empty-config.
- Drive-by: fix stale repo-method names in test_services_live.py
  (create_topology_decky → add_topology_decky, get_topology_decky → list+pick helper,
  service.added → service_added topic).

decnet/web/db/models/decky.py

@@ -51,8 +51,14 @@ class DeckyServiceAddRequest(BaseModel):
     and must NOT be ``fleet_singleton`` — those run once fleet-wide,
     not per-decky.  Validation happens server-side in the engine layer
     and surfaces as 422.
+
+    ``config`` carries optional initial per-service config (same shape as
+    DeckyServiceConfigRequest.config) so the freshly-added container
+    comes up with the operator's env from the start, no follow-up Apply
+    needed.  Empty dict = build with defaults.
     """
     name: str = PydanticField(..., min_length=1)
+    config: dict[str, Any] = PydanticField(default_factory=dict)
 
 
 class DeckyServicesResponse(BaseModel):

decnet/web/router/deckies/api_services.py

@@ -61,7 +61,7 @@ def _map_mutation_error(exc: ServiceMutationError) -> HTTPException:
     "/deckies/{decky_name}/services",
     response_model=DeckyServicesResponse,
     responses={
-        400: {"description": "Malformed request body"},
+        400: {"description": "Malformed request body or initial config rejected by service schema"},
         401: {"description": "Could not validate credentials"},
         403: {"description": "Insufficient permissions"},
         404: {"description": "Decky not found"},
@@ -78,7 +78,10 @@ async def api_fleet_add_service(
         services = await add_service(
             repo, decky_kind="fleet",
             decky_name=decky_name, service_name=req.name,
+            config=req.config,
         )
+    except ConfigValidationError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
     except ServiceMutationError as exc:
         raise _map_mutation_error(exc) from exc
     return DeckyServicesResponse(decky_name=decky_name, services=services)
@@ -197,7 +200,7 @@ async def api_fleet_remove_service(
     "/{topology_id}/deckies/{decky_name}/services",
     response_model=DeckyServicesResponse,
     responses={
-        400: {"description": "Malformed request body"},
+        400: {"description": "Malformed request body or initial config rejected by service schema"},
         401: {"description": "Could not validate credentials"},
         403: {"description": "Insufficient permissions"},
         404: {"description": "Topology or decky not found"},
@@ -215,7 +218,10 @@ async def api_topology_add_service(
         services = await add_service(
             repo, decky_kind="topology", topology_id=topology_id,
             decky_name=decky_name, service_name=req.name,
+            config=req.config,
         )
+    except ConfigValidationError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
     except ServiceMutationError as exc:
         raise _map_mutation_error(exc) from exc
     return DeckyServicesResponse(