ccm,ocm: add reverse proxy support for external credentials

Allow two CCM/OCM instances to share credentials when only one has a
public IP, using yamux-multiplexed reverse connections.

Three credential modes:
- Normal: URL set, reverse=false — standard HTTP proxy
- Receiver: URL empty — waits for incoming reverse connection
- Connector: URL set, reverse=true — dials out to establish connection

Extend InterfaceUpdated to services so network changes trigger
reverse connection reconnection.

option/ccm.go

@@ -95,9 +95,10 @@ type CCMBalancerCredentialOptions struct {
 }
 
 type CCMExternalCredentialOptions struct {
-	URL string `json:"url"`
+	URL string `json:"url,omitempty"`
 	ServerOptions
 	Token        string             `json:"token"`
+	Reverse      bool               `json:"reverse,omitempty"`
 	Detour       string             `json:"detour,omitempty"`
 	UsagesPath   string             `json:"usages_path,omitempty"`
 	PollInterval badoption.Duration `json:"poll_interval,omitempty"`