feat: replace hardcoded docker-compose IPs with .env-based substitution

docker-compose.yml now uses ${VAR:-default} for every container IP and
the network subnet, so there are no hardcoded addresses in the YAML.

How it works:
- setup_cell.py generates .env at project root from ip_range (gitignored).
- docker-compose reads .env automatically at startup.
- When ip_range changes in Settings, the API writes a new .env via
  ip_utils.write_env_file(); DNS/firewall/vIPs update immediately.
- User runs `make start` to recreate containers with the new IPs.

api/ip_utils.py gains ENV_VAR_NAMES dict and write_env_file(ip_range, path).
The old update_docker_compose_ips() direct-patch approach is removed from app.py.
3 new tests added (TestWriteEnvFile); total 324 pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -17,7 +17,7 @@ services:
       - NET_ADMIN
     networks:
       cell-network:
-        ipv4_address: 172.20.0.2
+        ipv4_address: ${CADDY_IP:-172.20.0.2}
     logging:
       driver: json-file
       options:
@@ -38,7 +38,7 @@ services:
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.3
+        ipv4_address: ${DNS_IP:-172.20.0.3}
     logging:
       driver: json-file
       options:
@@ -57,7 +57,7 @@ services:
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.4
+        ipv4_address: ${DHCP_IP:-172.20.0.4}
     command: ["/bin/sh", "-c", "apk add --no-cache dnsmasq && dnsmasq -d -C /etc/dnsmasq.conf"]
     cap_add:
       - NET_ADMIN
@@ -78,7 +78,7 @@ services:
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.5
+        ipv4_address: ${NTP_IP:-172.20.0.5}
     cap_add:
       - SYS_TIME
     command: ["/bin/sh", "-c", "apk add --no-cache chrony && rm -f /var/run/chrony/chronyd.pid && exec chronyd -d -f /etc/chrony/chrony.conf -n"]
@@ -108,7 +108,7 @@ services:
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.6
+        ipv4_address: ${MAIL_IP:-172.20.0.6}
     cap_add:
       - NET_ADMIN
     logging:
@@ -129,7 +129,7 @@ services:
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.7
+        ipv4_address: ${RADICALE_IP:-172.20.0.7}
     logging:
       driver: json-file
       options:
@@ -151,7 +151,7 @@ services:
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.8
+        ipv4_address: ${WEBDAV_IP:-172.20.0.8}
     logging:
       driver: json-file
       options:
@@ -174,7 +174,7 @@ services:
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.9
+        ipv4_address: ${WG_IP:-172.20.0.9}
     cap_add:
       - NET_ADMIN
       - SYS_MODULE
@@ -201,11 +201,12 @@ services:
       - ./config/dns:/app/config/dns
       - ./data/logs:/app/api/data/logs
       - /var/run/docker.sock:/var/run/docker.sock
+      - ./.env:/app/.env.compose
     pid: host
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.10
+        ipv4_address: ${API_IP:-172.20.0.10}
     depends_on:
       - wireguard
       - dns
@@ -224,7 +225,7 @@ services:
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.11
+        ipv4_address: ${WEBUI_IP:-172.20.0.11}
     logging:
       driver: json-file
       options:
@@ -238,7 +239,7 @@ services:
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.12
+        ipv4_address: ${RAINLOOP_IP:-172.20.0.12}
     ports:
       - "8888:8888"
     volumes:
@@ -256,7 +257,7 @@ services:
     restart: unless-stopped
     networks:
       cell-network:
-        ipv4_address: 172.20.0.13
+        ipv4_address: ${FILEGATOR_IP:-172.20.0.13}
     ports:
       - "8082:8080"
     volumes:
@@ -272,4 +273,4 @@ networks:
     driver: bridge
     ipam:
       config:
-        - subnet: 172.20.0.0/16
+        - subnet: ${CELL_NETWORK:-172.20.0.0/16}