feat: add/remove services in detail panel + fix service URL detection

- Any TCP service (except port 22 and known non-HTTP protocols) is now
  clickable — fixes Sonarr, Radarr, Jellyfin, Proxmox web UI, etc.
- HTTPS auto-detected for port 443/8443 or names containing ssl/tls/https
- Non-HTTP blocklist: FTP, SMTP, DNS, LDAP, SMB, MySQL, Postgres,
  Redis, MongoDB, Kafka, Memcached, etc.
- Inline "Add service" form in detail panel (name, port, tcp/udp)
- Remove button (×) on hover for each service row
- Group rect nodes excluded from detail panel
- getServiceUrl extracted to utils/serviceUrl.ts
- 13 new tests (79 total, all pass)

frontend/src/utils/serviceUrl.ts

@@ -0,0 +1,34 @@
+import type { ServiceInfo } from '@/types'
+
+// Ports that are definitely not HTTP/web services (port 22/SSH handled separately)
+const NON_HTTP_PORTS = new Set([
+  21,             // FTP
+  23,             // Telnet
+  25, 465, 587,   // SMTP
+  53,             // DNS
+  110, 143, 993, 995,   // IMAP / POP3
+  389, 636,       // LDAP
+  445,            // SMB
+  514,            // Syslog
+  1433,           // MSSQL
+  3306,           // MySQL
+  5432,           // PostgreSQL
+  5672,           // RabbitMQ AMQP
+  6379,           // Redis
+  9092,           // Kafka
+  11211,          // Memcached
+  27017, 27018,   // MongoDB
+])
+
+export function getServiceUrl(svc: ServiceInfo, host?: string): string | null {
+  if (!host) return null
+  if (svc.port === 22) return null        // SSH — no browser
+  if (svc.protocol === 'udp') return null // UDP — not HTTP
+  if (NON_HTTP_PORTS.has(svc.port)) return null
+
+  const name = svc.service_name.toLowerCase()
+  const isHttps =
+    name.includes('https') || name.includes('ssl') || name.includes('tls') ||
+    svc.port === 443 || svc.port === 8443
+  return `${isHttps ? 'https' : 'http'}://${host}:${svc.port}`
+}