feat(topology): thread per-service config overrides through compose

MazeNET phase 2 step 2. Mirrors the flat-fleet service_config pattern
(DeckyConfig.service_config → composer → svc.compose_fragment) into the
topology compose pipeline, so a hand-authored decky can carry overrides
like {"ssh": {"password": "megapassword"}} and the ssh fragment reads
them just like the flat path does.

- _PlannedDecky gains service_config: dict[str, dict].
- persist() stores it under decky_config["service_config"].
- topology/compose.py passes cfg.get("service_config", {}).get(svc, {})
  to svc.compose_fragment(service_cfg=...).

Schema unchanged — service_config lives inside the existing
decky_config JSON blob. Zero changes in decnet/services/*.

decnet/topology/compose.py

@@ -62,6 +62,7 @@ def generate_topology_compose(hydrated: dict[str, Any]) -> dict:
         name = cfg["name"]
         ips_by_lan: dict[str, str] = cfg["ips_by_lan"]
         forwards_l3: bool = cfg.get("forwards_l3", False)
+        service_config: dict[str, dict] = cfg.get("service_config", {}) or {}
         svc_names: list[str] = decky["services"]
 
         base_key = name
@@ -92,7 +93,9 @@ def generate_topology_compose(hydrated: dict[str, Any]) -> dict:
             svc = get_service(svc_name)
             if svc is None or svc.fleet_singleton:
                 continue
-            fragment = svc.compose_fragment(name, service_cfg={})
+            fragment = svc.compose_fragment(
+                name, service_cfg=service_config.get(svc_name, {})
+            )
             if "build" in fragment:
                 fragment["build"].setdefault("args", {}).setdefault(
                     "BASE_IMAGE", _DEFAULT_BASE_IMAGE

decnet/topology/config.py

@@ -69,6 +69,10 @@ class _PlannedDecky:
     # Mapping LAN-name → assigned IP within that LAN's subnet.
     ips_by_lan: dict[str, str] = field(default_factory=dict)
     forwards_l3: bool = False  # only meaningful when present on ≥2 LANs
+    # Per-service config overrides: {service_name: {field: value}}.
+    # Mirrors ``DeckyConfig.service_config`` from the flat-fleet path;
+    # services read these via ``compose_fragment(service_cfg=...)``.
+    service_config: dict[str, dict] = field(default_factory=dict)
 
 
 @dataclass

decnet/topology/persistence.py

@@ -52,6 +52,7 @@ async def persist(repo: Any, plan: GeneratedTopology) -> str:
                     "services": decky.services,
                     "ips_by_lan": decky.ips_by_lan,
                     "forwards_l3": decky.forwards_l3,
+                    "service_config": decky.service_config,
                 },
                 "ip": primary_ip,
             }