feat: replace hardcoded docker-compose IPs with .env-based substitution

docker-compose.yml now uses ${VAR:-default} for every container IP and
the network subnet, so there are no hardcoded addresses in the YAML.

How it works:
- setup_cell.py generates .env at project root from ip_range (gitignored).
- docker-compose reads .env automatically at startup.
- When ip_range changes in Settings, the API writes a new .env via
  ip_utils.write_env_file(); DNS/firewall/vIPs update immediately.
- User runs `make start` to recreate containers with the new IPs.

api/ip_utils.py gains ENV_VAR_NAMES dict and write_env_file(ip_range, path).
The old update_docker_compose_ips() direct-patch approach is removed from app.py.
3 new tests added (TestWriteEnvFile); total 324 pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/setup_cell.py

@@ -193,11 +193,23 @@ def write_cell_config(cell_name: str, domain: str, port: int):
     print(f'[CREATED] config/api/cell_config.json  name={cell_name}  domain={domain}')
 
 
+def write_compose_env(ip_range: str):
+    """Generate .env at project root so docker-compose picks up correct container IPs."""
+    sys.path.insert(0, os.path.join(ROOT, 'api'))
+    import ip_utils
+    env_path = os.path.join(ROOT, '.env')
+    if ip_utils.write_env_file(ip_range, env_path):
+        print(f'[CREATED] .env  (ip_range={ip_range})')
+    else:
+        print(f'[WARN]    Could not write .env — containers will use built-in default IPs')
+
+
 def main():
     cell_name = os.environ.get('CELL_NAME', 'mycell')
     domain = os.environ.get('CELL_DOMAIN', 'cell')
     vpn_address = os.environ.get('VPN_ADDRESS', '10.0.0.1/24')
     wg_port = int(os.environ.get('WG_PORT', '51820'))
+    ip_range = os.environ.get('CELL_IP_RANGE', '172.20.0.0/16')
 
     print('--- Personal Internet Cell: Setup ---')
     print(f'    cell={cell_name}  domain={domain}  vpn={vpn_address}  port={wg_port}')
@@ -212,6 +224,7 @@ def main():
     priv, _pub = generate_wg_keys()
     write_wg0_conf(priv, vpn_address, wg_port)
     write_cell_config(cell_name, domain, wg_port)
+    write_compose_env(ip_range)
 
     print()
     print('--- Setup complete! Run: make start ---')