fix: peer access to /api/services/active and unconditional Caddy startup regen

- Add _PEER_READABLE_PATHS allowlist in enforce_auth so peer-role sessions
  can read /api/services/active; fixes My Services showing 'not installed'
  for cell members when services are installed
- Move Caddy regeneration before the early-return in reapply_on_startup so
  the Caddyfile is always rebuilt from current identity on startup, even when
  no store services are installed; fixes ERR_SSL_PROTOCOL_ERROR after a cell
  rename (Caddyfile retained old wildcard domain)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/service_store_manager.py

@@ -407,6 +407,19 @@ class ServiceStoreManager(BaseServiceManager):
         from firewall_manager import apply_service_rules
 
         installed = self.config_manager.get_installed_services()
+
+        # Always regenerate the Caddyfile so a cell rename or fresh install
+        # produces the correct domain even when no store services are installed.
+        try:
+            caddy_routes = [
+                r.get('caddy_route')
+                for r in (installed or {}).values()
+                if r.get('caddy_route')
+            ]
+            self.caddy_manager.regenerate_with_installed(caddy_routes)
+        except Exception as e:
+            logger.warning(f'reapply_on_startup: caddy regenerate failed: {e}')
+
         if not installed:
             return
 
@@ -419,17 +432,6 @@ class ServiceStoreManager(BaseServiceManager):
             except Exception as e:
                 logger.warning(f'reapply_on_startup: apply_service_rules({svc_id}) failed: {e}')
 
-        # Regenerate Caddyfile
-        try:
-            caddy_routes = [
-                r.get('caddy_route')
-                for r in installed.values()
-                if r.get('caddy_route')
-            ]
-            self.caddy_manager.regenerate_with_installed(caddy_routes)
-        except Exception as e:
-            logger.warning(f'reapply_on_startup: caddy regenerate failed: {e}')
-
         # Bring up per-service compose stacks
         if self.service_composer is not None:
             try: