Phase 4: service store — manifest validation, install/remove, Store UI

- ServiceStoreManager: manifest allowlist (git.pic.ngo/roof/*), volume
  denylist, ACCEPT-only iptables rules, ${SERVICE_IP}-only dest_ip
- IP allocator: pool 172.20.0.20-254, skips CONTAINER_OFFSETS VIPs
- Compose overlay: docker-compose.services.yml auto-included via DCF
- Flask blueprint at /api/store: list, install, remove, refresh
- Store.jsx: full install/remove UI with spinners and toast notifications
- 95 new unit tests for ServiceStoreManager (all passing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/caddy_manager.py

@@ -373,6 +373,12 @@ class CaddyManager(BaseServiceManager):
 
     # ── certificate status ────────────────────────────────────────────────
 
+    def regenerate_with_installed(self, installed_services: list) -> bool:
+        """Regenerate Caddyfile with installed services and reload."""
+        identity = self.config_manager.get_identity()
+        content = self.generate_caddyfile(identity, installed_services)
+        return self.write_caddyfile(content)
+
     def get_cert_status(self) -> Dict[str, Any]:
         """Return TLS cert status from identity['tls'] if present."""
         default = {'status': 'unknown', 'expiry': None, 'days_remaining': None}