feat(topology): thread per-service config overrides through compose

MazeNET phase 2 step 2. Mirrors the flat-fleet service_config pattern
(DeckyConfig.service_config → composer → svc.compose_fragment) into the
topology compose pipeline, so a hand-authored decky can carry overrides
like {"ssh": {"password": "megapassword"}} and the ssh fragment reads
them just like the flat path does.

- _PlannedDecky gains service_config: dict[str, dict].
- persist() stores it under decky_config["service_config"].
- topology/compose.py passes cfg.get("service_config", {}).get(svc, {})
  to svc.compose_fragment(service_cfg=...).

Schema unchanged — service_config lives inside the existing
decky_config JSON blob. Zero changes in decnet/services/*.

decnet/topology/persistence.py

@@ -52,6 +52,7 @@ async def persist(repo: Any, plan: GeneratedTopology) -> str:
                     "services": decky.services,
                     "ips_by_lan": decky.ips_by_lan,
                     "forwards_l3": decky.forwards_l3,
+                    "service_config": decky.service_config,
                 },
                 "ip": primary_ip,
             }