feat: replace hardcoded docker-compose IPs with .env-based substitution

docker-compose.yml now uses ${VAR:-default} for every container IP and
the network subnet, so there are no hardcoded addresses in the YAML.

How it works:
- setup_cell.py generates .env at project root from ip_range (gitignored).
- docker-compose reads .env automatically at startup.
- When ip_range changes in Settings, the API writes a new .env via
  ip_utils.write_env_file(); DNS/firewall/vIPs update immediately.
- User runs `make start` to recreate containers with the new IPs.

api/ip_utils.py gains ENV_VAR_NAMES dict and write_env_file(ip_range, path).
The old update_docker_compose_ips() direct-patch approach is removed from app.py.
3 new tests added (TestWriteEnvFile); total 324 pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -481,33 +481,24 @@ def update_config():
         if identity_updates.get('ip_range'):
             import ip_utils
             new_range = identity_updates['ip_range']
-            old_range = old_identity.get('ip_range', os.environ.get('CELL_IP_RANGE', '172.20.0.0/16'))
             cur_identity = config_manager.configs.get('_identity', {})
             cur_cell_name = cur_identity.get('cell_name', os.environ.get('CELL_NAME', 'mycell'))
             cur_domain = cur_identity.get('domain', os.environ.get('CELL_DOMAIN', 'cell'))
-            # Update DNS zone records
+            # Update DNS zone records immediately
             ip_result = network_manager.apply_ip_range(new_range, cur_cell_name, cur_domain)
             all_restarted.extend(ip_result.get('restarted', []))
             all_warnings.extend(ip_result.get('warnings', []))
-            # Update firewall virtual IPs (iptables) and Caddy virtual IPs
+            # Update firewall virtual IPs (iptables) and Caddy virtual IPs immediately
             firewall_manager.update_service_ips(new_range)
             firewall_manager.ensure_caddy_virtual_ips()
-            # Try to update docker-compose.yml (only works outside container / dev mode)
-            compose_candidates = [
-                os.environ.get('COMPOSE_FILE', ''),
-                '/app/../docker-compose.yml',
-                os.path.join(os.path.dirname(__file__), '..', 'docker-compose.yml'),
-            ]
-            compose_updated = False
-            for cpath in compose_candidates:
-                if cpath and ip_utils.update_docker_compose_ips(old_range, new_range, cpath):
-                    all_warnings.append(
-                        'docker-compose.yml updated — run `make restart` to apply container IP changes')
-                    compose_updated = True
-                    break
-            if not compose_updated:
+            # Write new .env so docker-compose picks up new container IPs on next start
+            env_file = os.environ.get('COMPOSE_ENV_FILE', '/app/.env.compose')
+            if ip_utils.write_env_file(new_range, env_file):
                 all_warnings.append(
-                    'docker-compose.yml not updated (run `make reinstall` to apply container IP changes)')
+                    'Container IPs updated — run `make start` to apply to running containers')
+            else:
+                all_warnings.append(
+                    'Could not write .env — run `make setup && make start` to apply container IP changes')
 
         logger.info(f"Updated config, restarted: {all_restarted}")
         return jsonify({