fix: DNS first-install — split-horizon zone creation + CoreDNS inode bind-mount

VPN clients got dns_probe_finished_bad_config / couldn't resolve any domain
after first setup because:

1. complete_setup() never wrote the split-horizon DNS zone for non-LAN modes;
   SetupManager now accepts network_manager as an optional 3rd constructor
   param, and complete_setup() calls
   self.network_manager.update_split_horizon_zone(effective_domain, wg_ip,
   primary_domain) for pic_ngo/cell_to_cell modes.

2. generate_corefile() used a tmp-file + os.replace pattern; the Corefile is
   a Docker FILE bind-mount, so os.replace orphaned the inode and CoreDNS
   never saw config updates.  Fixed by truncating and rewriting in place
   (open with 'w', seek(0), truncate()), preserving the inode CoreDNS holds.

api/managers.py passes network_manager into SetupManager.
Tests: new mock_network_manager fixture, 2 setup-zone tests, 1 inode
regression test in test_firewall_manager.py.
Verified live on pic1.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_firewall_manager.py

@@ -132,6 +132,18 @@ class TestGenerateCorefile(unittest.TestCase):
         content = open(self.path).read()
         self.assertIn('reload', content)
 
+    def test_rewrite_preserves_inode(self):
+        # Regression: the Corefile is a Docker FILE bind-mount, so it must be
+        # rewritten in place. os.replace() would swap the inode and the
+        # container would keep reading stale config forever.
+        firewall_manager.generate_corefile([], self.path)
+        first_inode = os.stat(self.path).st_ino
+        peers = [_make_peer('10.0.0.3', internet=False, services=['calendar'])]
+        firewall_manager.generate_corefile(peers, self.path)
+        self.assertEqual(os.stat(self.path).st_ino, first_inode)
+        # And the new content actually landed in that same inode.
+        self.assertIn('block net 10.0.0.3/32', open(self.path).read())
+
     def test_returns_false_on_write_error(self):
         with unittest.mock.patch('builtins.open', side_effect=OSError('Permission denied')):
             result = firewall_manager.generate_corefile([], '/any/path/Corefile')