feat(proxy): support managed dynamic extensions

[vishr]

Summary

• allow proxy.config to contain dynamic YAML or TOML while Onebox retains the managed static configuration
• preserve full custom static ownership when traefik.yml or traefik.yaml is present
• create the nested dynamic mountpoint required below the read-only Traefik configuration mount
• validate ambiguous or ineffective extension layouts
• update generated schema descriptions and the project-file reference

Why

Adding one middleware should not require applications to duplicate entrypoints, discovery, health, and ACME configuration. Static install policy stays managed by default; dynamic routing policy remains extensible, with full static configuration as the escape hatch.

Verification

• just check
• typos on changed Go and documentation files
• focused proxy, app, and engine tests (1107 tests)