feat(services): initial config on ADD SERVICE — schema modal in DeckyCard, MazeNET drag, and Inspector

- DeckyServiceAddRequest gains an optional `config: dict` field, validated
  against the service's config_schema before any state mutation (400 on
  bad type, no half-written rows).
- Engine: add_service threads `config` into _add_topology_service /
  _add_fleet_service, persisting validated cfg to decky_config.service_config
  BEFORE compose regen so the first `up -d --build` materialises the env on
  the new container. No follow-up apply needed.
- Frontend: shared AddServiceConfigModal — same wizard accordion shape, used by:
    * DeckyCard's ADD SERVICE picker (Fleet & MazeNET inspectors via shared component)
    * MazeNET Inspector's ADD SERVICE picker
    * MazeNET palette drag-drop onto a deployed decky
  Empty-schema services short-circuit to a one-click add (no modal flash).
  Operator can cancel; errors surface in the modal.
- Tests: add_service config plumbing — persist, drop unknown keys, 400-equivalent
  on bad types, back-compat empty-config.
- Drive-by: fix stale repo-method names in test_services_live.py
  (create_topology_decky → add_topology_decky, get_topology_decky → list+pick helper,
  service.added → service_added topic).

decnet/web/db/models/decky.py

@@ -51,8 +51,14 @@ class DeckyServiceAddRequest(BaseModel):
     and must NOT be ``fleet_singleton`` — those run once fleet-wide,
     not per-decky.  Validation happens server-side in the engine layer
     and surfaces as 422.
+
+    ``config`` carries optional initial per-service config (same shape as
+    DeckyServiceConfigRequest.config) so the freshly-added container
+    comes up with the operator's env from the start, no follow-up Apply
+    needed.  Empty dict = build with defaults.
     """
     name: str = PydanticField(..., min_length=1)
+    config: dict[str, Any] = PydanticField(default_factory=dict)
 
 
 class DeckyServicesResponse(BaseModel):