feat: replace hardcoded service names with ServiceRegistry-driven Caddy and CoreDNS config

Previously, CaddyManager and NetworkManager contained hardcoded lists of
service names (calendar, files, mail, webdav, etc.), meaning every new
service required a code change to appear in Caddy routes and DNS records.
Now both managers accept a service_registry parameter and derive their
service lists dynamically from the registry at runtime.

- CaddyManager: new _build_registry_service_routes() and
  _http01_service_pairs() methods pull routes from the registry
- NetworkManager: new _get_service_subdomains() method returns registry
  subdomains with a hardcoded fallback when no registry is wired in;
  _build_dns_records, stale-record detection, and service name sets all
  use the registry
- managers.py: service_registry constructed before network_manager so it
  can be injected into both CaddyManager and NetworkManager
- service_registry.py: validation chokepoint in get_caddy_routes() rejects
  invalid subdomain/backend values and reserved service names
- service_store_manager.py: _validate_manifest now validates top-level
  subdomain, backend, extra_subdomains, and extra_backends fields
- tests: 24 new tests covering registry-driven routing and DNS subdomain
  generation (test_caddy_registry_integration.py)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_config_backup_restore_http.py

@@ -119,14 +119,17 @@ class TestRestoreConfigBackup(unittest.TestCase):
             content_type='application/json',
         )
         mock_cm.restore_config.assert_called_once_with(
-            'backup_001', services=['network', 'wireguard']
+            'backup_001', services=['network', 'wireguard'], service_registry=None
         )
 
     @patch('app.config_manager')
     def test_restore_passes_none_services_when_no_body(self, mock_cm):
+        from unittest.mock import ANY
         mock_cm.restore_config.return_value = True
         self.client.post('/api/config/restore/backup_001')
-        mock_cm.restore_config.assert_called_once_with('backup_001', services=None)
+        mock_cm.restore_config.assert_called_once_with(
+            'backup_001', services=None, service_registry=ANY
+        )
 
 
 class TestExportConfig(unittest.TestCase):