feat(web): load deploy route options from the gateway

[imneov]

What type of PR is this?

• bug fix
• feature
• documentation
• CI / tooling
• breaking: API, config key, chart value, or CRD field changed

What this PR does and why

The deploy form's bundled option list and placeholders drifted from the running OpenResty engine. Read its public /<route>/_route_opts catalog through an authenticated console API instead.

• Group common directives and keep engine internals in the advanced picker.
• Show deployment-specific defaults as placeholders; keep existing route runtime values and their source separate from editable overrides.
• Use bundled metadata without default values only when the catalog is unsupported or no route exists; surface other failures.
• Preserve unknown options, per-key locale fallback, existing chart/SLO semantics and the copied Swiss module.
• Cover missing-gateway SPA fallthrough, old-plan route identity and native desktop picker interaction.

Which issue(s) this PR fixes

Fixes #52

How it was tested

• go test ./..., go vet ./..., Go formatting and patch whitespace checks.
• npm run typecheck, full frontend suite and npm run build on the branch based on current main.
• Real released OpenResty 0.1.26 in an isolated local container: 16 common and 24 advanced options; changed host defaults (TPS 73, floor fraction 0.61) and route value 81/set=true.
• Existing preview APIs and desktop browser: live defaults render without becoming submitted overrides; blank advanced values are omitted; native pointer selection remains usable.
• Portable live check: CONSOLE_URL=<preview-url> node hack/check-route-catalog-live.mjs.
• No install/apply operation, no business-release history rewrite, no mobile sizing changes.

Checks

• go test ./... and gofmt -l . is empty
• npm run typecheck && npm test && npm run build in web/
• helm lint --strict helm/console (chart unchanged)
• Docs updated where behaviour changed
• No internal hostnames, IPs, registries or credentials

Notes for reviewers

Start with the route catalog handler and gateway catalog discovery, then the inference-module API adapter and form. The API is additive and reuses the existing backend read grant. Engine-side validation remains authoritative. Desktop-only acceptance per the originating request.

Release note

Deploy and upgrade forms now read route options and host defaults from OpenResty, with a safe legacy fallback and separate runtime-state display.