fix: peer access to /api/services/active and unconditional Caddy startup regen

- Add _PEER_READABLE_PATHS allowlist in enforce_auth so peer-role sessions
  can read /api/services/active; fixes My Services showing 'not installed'
  for cell members when services are installed
- Move Caddy regeneration before the early-return in reapply_on_startup so
  the Caddyfile is always rebuilt from current identity on startup, even when
  no store services are installed; fixes ERR_SSL_PROTOCOL_ERROR after a cell
  rename (Caddyfile retained old wildcard domain)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -187,6 +187,13 @@ def enforce_setup():
         return jsonify({'error': 'Setup required', 'redirect': '/setup'}), 428
 
 
+# Read-only endpoints accessible to peer-role sessions (not just admin).
+# Add paths here when peers need to read shared cell state.
+_PEER_READABLE_PATHS = frozenset({
+    '/api/services/active',
+})
+
+
 @app.before_request
 def enforce_auth():
     """Enforce session-based authentication and role-based access control.
@@ -238,6 +245,8 @@ def enforce_auth():
     if path.startswith('/api/peer/'):
         if role != 'peer':
             return jsonify({'error': 'Forbidden'}), 403
+    elif path in _PEER_READABLE_PATHS:
+        pass  # both admin and peer may read these endpoints
     else:
         if role != 'admin':
             return jsonify({'error': 'Forbidden'}), 403