Add built-in reverse proxy, automatic SSL, and dev mode support

[andyquinterom]

This PR significantly enhances Dispenser's capabilities as a single-VM container orchestrator by introducing a built-in reverse proxy with automatic SSL, a simplified default networking model, and a new developer-focused CLI command.

Key Changes

1. Built-in Reverse Proxy & Automatic SSL

• Added a high-performance reverse proxy that handles TLS termination.
• Integrated Let's Encrypt support via a new [certbot] configuration block in dispenser.toml for automated certificate management.
• Services can now easily expose themselves via the [proxy] block in service.toml, specifying their public hostname and internal port.

2. Deterministic Networking

• Introduced a default Docker network named dispenser (subnet 172.28.0.0/16).
• All containers are now connected to this network by default, enabling zero-configuration service discovery. Services can communicate using their service names as hostnames without explicit network declarations.
• Support for custom network overrides remains available for advanced use cases.

3. New dev Subcommand

• Added dispenser dev to streamline local development:
  • Selective Loading: Only run specific services using -s/--service.
  • Implicit Simulation: Automatically generates self-signed certificates for all proxy hosts to test SSL locally.
  • Dependency Pruning: Automatically skips dependencies for services not included in the current dev run, allowing for faster startup.

4. Documentation & CLI Updates

• Updated README.md with step-by-step guides for the new networking and proxy features.
• Expanded CLI.md to document the dev subcommand and updated global usage patterns.
• Refined the README.md introduction to reflect Dispenser's role as a "simple, declarative, and deterministic container orchestrator."