docs: Phase 7 — update docs to reflect optional services migration

Email, calendar, and files are now optional store services, not always-on
builtins. Updated README, QUICKSTART, Wiki, and service-developer-guide to
reflect: dynamic nav, optional service install flow, correct egress
identifiers (wireguard_ext/default vs wireguard/cell_internet), removed
builtin/store distinction from manifest reference, 7 core containers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

QUICKSTART.md

@@ -8,7 +8,8 @@ This guide walks through a first-time PIC installation on a clean Linux host.
 
 - Linux x86-64 host — Debian, Ubuntu, Fedora, RHEL, or Alpine
 - 2 GB+ RAM, 10 GB+ disk
-- Ports 53, 80, 443, 51820/udp, 25, 587, 993 available
+- Always-required ports: 53, 80, 443, 51820/udp
+- Email service only (when installed): 25, 587, 993
 
 The installer handles all software dependencies (git, docker, make, etc.) automatically.
 
@@ -71,10 +72,10 @@ The wizard asks for:
   - `http01` — Let's Encrypt via HTTP-01 (no wildcard; cell must be reachable on port 80)
   - `lan` — internal CA, no internet required (for LAN-only installs)
 - **Timezone**
-- **Services to enable** — email, calendar, files, WireGuard
+- **Services to install** — email, calendar, files (optional; installed in the background after setup completes; can be added later via the Services store page)
 - **Admin password** — minimum 12 characters, must contain uppercase, lowercase, and a digit
 
-Click **Complete Setup**. The wizard creates the admin account, writes cell identity to `config/api/cell_config.json`, and redirects to the login page.
+Click **Complete Setup**. The wizard creates the admin account, writes cell identity to `config/api/cell_config.json`, and redirects to the login page. Any services you selected begin installing in the background.
 
 ---
 
@@ -101,6 +102,31 @@ Once connected, `*.cell` names resolve through the cell's CoreDNS and traffic ca
 
 ---
 
+## Installing and managing services
+
+Email, calendar, and file storage are optional services installed from the built-in service store. They are not running by default.
+
+**To install a service:**
+
+1. Go to **Services** in the sidebar.
+2. Find the service card (Email, Calendar, Files, or any other listed service).
+3. Click **Install**. PIC fetches the manifest, starts the container, and wires up DNS and Caddy routes automatically.
+4. The service appears in the sidebar navigation once installation completes.
+
+**To check service status:**
+
+The Services page shows each installed service as "running" or "stopped". You can also check via the API:
+
+```bash
+curl -s http://<host-ip>:3000/api/services/active
+```
+
+**To uninstall a service:**
+
+Click **Uninstall** on the service card. The container is stopped and removed. Data in `data/services/<id>/` is kept on disk unless you delete it manually.
+
+---
+
 ## Day-to-day operations
 
 ```bash