feat(proxy): add named entrypoints

[vishr]

Summary

• add typed proxy.entrypoints listeners to the project contract
• publish declared TCP ports and render them into Onebox-owned Traefik static configuration
• preserve custom proxy.config ownership while publishing its declared listeners
• validate listener names, ports, built-in collisions, duplicates, and undeclared route entrypoints
• update generated schemas and field reference

Verification

• just check
• 1052 focused tests passed across internal/app, internal/proxy, and internal/engine

Closes #121