fix: add built-in service subdomains to DNS zone on startup

_build_dns_records() only hardcoded 'api' and 'webui', relying on the
optional service registry for the rest. Built-in services (calendar,
files, mail, webdav) were never registered, so they were absent from
the zone file and tests querying webdav.<domain> via CoreDNS got
NXDOMAIN.

Add _BUILTIN_SERVICE_SUBDOMAINS constant and include those names in
every zone build. Also update _stale and apply_cell_name exclusion
sets so DDNS mode correctly removes them from the parent zone.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/network_manager.py

@@ -203,7 +203,7 @@ class NetworkManager(BaseServiceManager):
         # domain (e.g. primary_domain='pic.ngo', effective_domain='pic2.pic.ngo'),
         # bootstrap service records like 'api', 'calendar' etc. would pollute the
         # zone display and shadow the public domain.  Remove them.
-        _stale = {'api', 'webui'} | set(self._get_service_subdomains())
+        _stale = {'api', 'webui'} | set(self._BUILTIN_SERVICE_SUBDOMAINS) | set(self._get_service_subdomains())
         if effective_domain.endswith('.' + primary_domain):
             existing = self._load_dns_records(primary_domain)
             cleaned = [r for r in existing if r.get('name', '') not in _stale]
@@ -270,6 +270,11 @@ class NetworkManager(BaseServiceManager):
                 logger.warning('_get_service_subdomains: registry error: %s', exc)
         return []
 
+    # Built-in service subdomains that are always present on a PIC instance.
+    # These must stay in sync with firewall_manager.SERVICE_IPS keys and the
+    # Caddy routes for each built-in service.
+    _BUILTIN_SERVICE_SUBDOMAINS = ('calendar', 'files', 'mail', 'webdav')
+
     def _build_dns_records(self, cell_name: str, ip_range: str) -> List[Dict]:
         """Build the standard set of DNS A records.
 
@@ -284,6 +289,8 @@ class NetworkManager(BaseServiceManager):
             {'name': 'api',     'type': 'A', 'value': wg_ip},
             {'name': 'webui',   'type': 'A', 'value': wg_ip},
         ]
+        for sub in self._BUILTIN_SERVICE_SUBDOMAINS:
+            records.append({'name': sub, 'type': 'A', 'value': wg_ip})
         for sub in self._get_service_subdomains():
             records.append({'name': sub, 'type': 'A', 'value': wg_ip})
         return records
@@ -614,7 +621,7 @@ class NetworkManager(BaseServiceManager):
         if not new_name:
             return {'restarted': restarted, 'warnings': warnings}
         # Exclude service names, wildcard, and apex from cell-hostname detection.
-        _service_names = {'api', 'webui'} | set(self._get_service_subdomains())
+        _service_names = {'api', 'webui'} | set(self._BUILTIN_SERVICE_SUBDOMAINS) | set(self._get_service_subdomains())
         _reserved = _service_names | {'@', '*'}
         changed = False
         try: