Render dynamic reverse-proxy routes from contract bindings

[RonaldHensbergen]

Scope

Generate reverse-proxy dynamic routing configuration from profile/plan bindings rather than provider autodiscovery.

Deliverables

• Render router/service/TLS route definitions from ${bindings.*} for exposed services.
• Preserve namespacing and interpolation conventions used by planner/renderer.
• Ensure generated config includes certificate resolver/reference wiring from the certificate mapping model.

Acceptance criteria

• Profiles with exposed services produce deterministic dynamic route config.
• Rendered output stays provider-config compatible and does not require label-based autodiscovery.
• Invalid routing inputs surface diagnostics instead of silently producing broken config.