feat: make DDNS domain_name the effective domain across all services

- ConfigManager.get_effective_domain(): returns domain_name when DDNS
  active (pic_ngo/cloudflare/duckdns), domain otherwise. Used by all
  public-facing services so they use the real registered FQDN.
- ConfigManager.get_internal_domain(): always returns _identity.domain
  (CoreDNS zone name, dnsmasq, cell-link invites — stays internal).
- Silent migration: if domain_mode != lan and domain is generic "cell",
  auto-set to {cell_name}.local for unique CoreDNS zone naming.
- caddy_manager: fix custom_domain bug — cloudflare/http01 modes were
  reading identity.get('custom_domain') which never exists; now reads
  domain_name correctly.
- routes/config, app: expose effective_domain in GET /api/config and
  /api/status responses.
- email_manager, routes/email: use get_effective_domain() for
  OVERRIDE_HOSTNAME, POSTMASTER_ADDRESS, and new-user email defaults.
- ServiceBus.IDENTITY_CHANGED event: emitted from PUT /api/config and
  POST /api/ddns/register after identity writes; caddy_manager and
  email_manager subscribe to regenerate config automatically.
- Settings.jsx: hide Local Domain input in non-LAN modes; show
  read-only effective_domain with "managed by DDNS" badge and an
  Advanced toggle for the internal CoreDNS zone name.
- 11 new test classes covering all new helpers, event subscriptions,
  caddy/email handlers, and the custom_domain fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routes/config.py

@@ -120,6 +120,7 @@ def get_config():
         config['service_configs'] = service_configs
         config['domain_mode'] = identity.get('domain_mode', 'lan')
         config['domain_name'] = identity.get('domain_name', '')
+        config['effective_domain'] = config_manager.get_effective_domain()
         ddns_section = config_manager.configs.get('ddns', {})
         config['ddns'] = {
             'provider': ddns_section.get('provider', ''),
@@ -376,6 +377,16 @@ def update_config():
                 pre_change_snapshot=_pre_change_snapshot,
             )
 
+        if identity_updates:
+            _cur_identity = config_manager.configs.get('_identity', {})
+            service_bus.publish_event(EventType.IDENTITY_CHANGED, 'config', {
+                'cell_name': _cur_identity.get('cell_name'),
+                'domain': _cur_identity.get('domain'),
+                'domain_name': _cur_identity.get('domain_name'),
+                'domain_mode': _cur_identity.get('domain_mode'),
+                'effective_domain': config_manager.get_effective_domain(),
+            })
+
         _PORT_CHANGE_MAP = {
             ('network',  'dns_port'):          ('dns_port',             ['dns']),
             ('wireguard','port'):               ('wg_port',              ['wireguard']),
@@ -579,6 +590,15 @@ def ddns_register():
         new_sub = result.get('subdomain', f'{cell_name}.pic.ngo')
         config_manager.set_identity_field('domain_name', new_sub)
         logger.info('DDNS registered via /api/ddns/register: cell_name=%r subdomain=%r', cell_name, new_sub)
+        from app import service_bus, EventType
+        _reg_identity = config_manager.configs.get('_identity', {})
+        service_bus.publish_event(EventType.IDENTITY_CHANGED, 'ddns_register', {
+            'cell_name': _reg_identity.get('cell_name'),
+            'domain': _reg_identity.get('domain'),
+            'domain_name': new_sub,
+            'domain_mode': _reg_identity.get('domain_mode'),
+            'effective_domain': config_manager.get_effective_domain(),
+        })
         return jsonify({'registered': True, 'subdomain': new_sub})
     except Exception as e:
         logger.error('Error in /api/ddns/register: %s', e)