fix: UI always accessible; fix exit-relay AllowedIPs not updating

**PIC UI always accessible (service_access=[])**
Remove the per-peer Caddy:80 ACCEPT/DROP rule from apply_peer_rules.
Service access was enforced at two layers (iptables DROP + CoreDNS ACL),
but the iptables layer also blocked the PIC web UI served through Caddy.
CoreDNS ACL alone is sufficient — DNS blocks service hostnames; the UI
path through Caddy remains reachable regardless of service_access value.

**Exit-relay internet routing (route_via another cell)**
update_peer_ip validated new_ip as a single ip_network, rejecting the
comma-separated '10.0.1.0/24, 0.0.0.0/0' string passed by
update_cell_peer_allowed_ips(add_default_route=True). The AllowedIPs
in wg0.conf was never updated, so WireGuard never routed internet traffic
through the exit cell's tunnel. Fix: validate each CIDR individually and
apply the change live via wg set without a container restart.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/firewall_manager.py

@@ -192,16 +192,9 @@ def apply_peer_rules(peer_ip: str, settings: Dict[str, Any]) -> bool:
         _iptables(['-I', 'FORWARD', '-s', peer_ip, '-d', '10.0.0.0/24',
                    '-m', 'comment', '--comment', comment, '-j', target])
 
-        # --- Step 3 (inserted last → ends up at TOP of chain) ---
-        # Service access via Caddy: DNS returns WG server IP for all services;
-        # ensure_service_dnat() routes wg0:80 to Caddy. One ACCEPT/DROP rule
-        # controls service access; CoreDNS ACL enforces per-name granularity.
-        caddy_ip = _get_caddy_container_ip()
-        if caddy_ip:
-            target = 'ACCEPT' if service_access else 'DROP'
-            _iptables(['-I', 'FORWARD', '-s', peer_ip, '-d', caddy_ip,
-                       '-p', 'tcp', '--dport', '80',
-                       '-m', 'comment', '--comment', comment, '-j', target])
+        # Service access restriction is done entirely by CoreDNS ACL.
+        # No per-peer iptables rule for Caddy:80 — blocking it would also
+        # prevent the peer from reaching the PIC web UI and API.
 
         logger.info(f"Applied rules for {peer_ip}: internet={internet_access} "
                     f"services={service_access} peers={peer_access}")