feat: Phase 2 — remove builtins layer, ServiceRegistry is installed-only

Builtins (email/calendar/files) are no longer baked into the API image.
ServiceRegistry now only knows about installed store services. When nothing
is installed, Caddy and DNS get no service routes — no hardcoded fallback.

Changes:
- service_registry.py: remove _BUILTINS_DIR, _builtin_ids, _builtin_manifest,
  _load_manifest; get() and list_all() now delegate entirely to installed services
- caddy_manager.py: remove _build_core_service_routes(); remove hardcoded
  fallback pairs from _http01_service_pairs(); empty registry → api block only
- network_manager.py: _get_service_subdomains() returns [] when no registry
- api/services/builtins/: deleted (email, calendar, files manifests)
- Tests updated throughout: removed builtin-dependent assertions, added
  installed-service fixtures, updated fallback expectations to api-only

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_network_manager.py

@@ -349,8 +349,12 @@ class TestApplyIpRange(unittest.TestCase):
         self.nm.apply_ip_range('10.1.2.0/24', 'pictest', 'mycell')
         zone_file = os.path.join(self.nm.dns_zones_dir, 'mycell.zone')
         content = open(zone_file).read()
-        for host in ('pictest', 'api', 'webui', 'calendar', 'files', 'mail', 'webmail', 'webdav'):
+        # Without a registry, only the infrastructure names are generated
+        for host in ('pictest', 'api', 'webui'):
             self.assertIn(host, content)
+        # Service records are only generated when a registry is wired
+        for host in ('calendar', 'files', 'mail', 'webmail', 'webdav'):
+            self.assertNotIn(host, content)
 
     @patch('subprocess.run')
     def test_same_range_updates_zone_without_error(self, _mock):
@@ -460,7 +464,21 @@ class TestUpdateSplitHorizonZone(unittest.TestCase):
 
     @patch('subprocess.run')
     def test_removes_stale_service_records_when_primary_is_parent(self, _mock):
-        """Stale LAN service names (api, calendar…) are removed from a parent zone."""
+        """Stale LAN service names (api, calendar…) are removed from a parent zone.
+
+        A registry that knows about calendar and files is required so those names
+        appear in the stale set.
+        """
+        from unittest.mock import MagicMock
+        registry = MagicMock()
+        registry.get_caddy_routes.return_value = [
+            {'service_id': 'calendar', 'subdomain': 'calendar',
+             'backend': 'cell-radicale:5232', 'extra_subdomains': [], 'extra_backends': {}},
+            {'service_id': 'files', 'subdomain': 'files',
+             'backend': 'cell-filegator:8080', 'extra_subdomains': [], 'extra_backends': {}},
+        ]
+        self.nm._service_registry = registry
+
         # Bootstrap a pic.ngo zone with service records (wrong internal zone name)
         stale_records = [
             {'name': 'pic2',    'type': 'A', 'value': '10.0.0.1'},