feat: connectivity redesign phase 2 — instance-aware routing + reference connections by id

apply_routes now iterates over connection instances rather than types:
each instance gets its own fwmark, routing table, interface, and
redirect_port via _routing_connections / _resolve_peer_connection /
_apply_connection_for_src; kill-switch is enforced per iface-instance.
Old per-type MARKS/TABLES constants are kept only as migration scaffolding.

peer_registry: exit_via is now stored as a connection id (or 'default');
_migrate_exit_via_to_connection_id runs on _load_peers to upgrade legacy
type-string values; set_peer_exit_via validates against known connection
ids; VALID_EXIT_VIA removed; config_manager wired in from managers.py.

egress_manager: egress_overrides keyed by service_id → connection_id;
local MARKS/TABLES/EXIT_TYPES/_REDIRECT_PORTS/_add_tor_redirect removed;
(mark, table, redirect_port) resolved at apply-time via
connectivity_manager.get_connection; manifest egress.allowed still
enforced by connection type.

api/app.py + api.js: PUT peer/service exit endpoints accept {connection_id};
back-compat shim resolves a legacy type string to its single active instance.

Tests extended: two same-type instances produce distinct marks/tables/ports;
peer exit_via and egress override id migrations round-trip correctly;
single-instance behaviour is equivalent to the old type-keyed path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

webui/src/services/api.js

@@ -360,8 +360,8 @@ export const setupAPI = {
 // Per-service Egress API
 export const egressAPI = {
   getStatus: () => api.get('/api/egress/status'),
-  setServiceExit: (serviceId, exitType) =>
-    api.put(`/api/egress/services/${serviceId}/exit`, { exit_type: exitType }),
+  setServiceExit: (serviceId, connectionId) =>
+    api.put(`/api/egress/services/${serviceId}/exit`, { connection_id: connectionId }),
 };
 
 // Connectivity / Exit Routing API
@@ -374,7 +374,7 @@ export const connectivityAPI = {
   configureProxy: (cfg) => api.post('/api/connectivity/exits/proxy', cfg),
   applyRoutes: () => api.post('/api/connectivity/exits/apply'),
   getPeerExits: () => api.get('/api/connectivity/peers'),
-  setPeerExit: (peer_name, exit_via) => api.put(`/api/connectivity/peers/${peer_name}/exit`, { exit_via }),
+  setPeerExit: (peer_name, connection_id) => api.put(`/api/connectivity/peers/${peer_name}/exit`, { connection_id }),
 };
 
 // Container Management API