api | operator | web | docs: rollout setting, domain options behind advanced settings, cron runs list

[bbedward]

Rollout setting (UNB-400)

A service can now pick how a deployment replaces the running version, under Rollout in Deploy:

• Rolling (default): the new version starts next to the old one and the old one stops once the new one is ready. No gap.
• Stop first: the old version stops before the new one starts, so the two never run at once. For bots, wallets and anything else that must not overlap. A few seconds of downtime per deployment. The image is pulled first, and an image that can't be pulled leaves the running version in place.

Plumbing: rollout enum (rolling | stop-first) on the service config, create/update inputs and the MCP tools; rollout on the Service CRD; the operator renders Recreate for stop-first, keeping the normal 5s stop grace. Services with a volume already stop first and show the setting locked.

Compatibility: the migration adds the column with default rolling, so existing rows keep rolling updates. Resources rendered before the change have no rollout; the API treats that as rolling when comparing, so nothing gets redeployed just for the upgrade.

UI fixes from last week's changes

• Domain forms: path, redirect, proxy, basic auth and response headers moved behind the existing Advanced Settings disclosure, with one-line descriptions. It opens on its own when the domain has an option set.
• Deploy section: cron schedule and time zone moved to the end, each in its own block.
• Cron runs: rebuilt on the deployment card pieces (status chip, tinted card, mono meta line), Run Now styled like the other tab header buttons, runs open their logs through a link.
• BlockItem dropped a description placed next to a row header (Redis append-only file was missing its text). Fixed.
• Shorter Client IP Header description, create team dialog and members page wording, CronScheduleNotice generalised to SettingNotice.

Docs updated for all of the above.