api | docs: create cron services without a detected port or domain

[bbedward]

Creating a service with cron_schedule and no ports still gave it the port detected from its source (Dockerfile EXPOSE, railpack analysis or image metadata). In CreateService that port makes resolveIsPublic answer true, and generateWildcardHost then adds a <name>.apps.<wildcard> domain. The operator never serves a scheduled service (removeExposure in service_controller.go, and routedHTTPHosts skips it on gateway clusters). So the domain only claimed the host, showed in the UI and fed UNBIND_URL_PUBLIC. Seen on banano for kalium-prices and bc-scan-failed-cleaner.

Fix: when a schedule is set and the caller sent no ports, the detected ports stay in detected_ports metadata only. The service starts with no port, so it is private and gets no generated domain.

Kept as is, for compatibility:

• Ports and hosts the caller sends explicitly are still stored. Refusing them would be new validation for API and MCP clients.
• Switching an existing service to a schedule leaves its domains alone. The cron docs promise they come back when the schedule is removed, and the update path never adds detected ports or domains anyway (UpdateGitSource only writes metadata).
• Creates without a schedule are unchanged, including the detected_ports stored for databases after node ports are allocated.
• No CRD or operator change.

The issue says replicas and ports are already refused on cron services. They aren't: the only cron check is the restart refusal in restart.go.

Docs: one line in Cron jobs.

Tests: TestSkipsDetectedPortsForCron covers the condition, plus resolveIsPublic giving no domain without a port. Not run against a live cluster.

fixes UNB-401