fix: port changes now correctly queue pending restart for all services

Two bugs fixed:

1. calendar_manager and wireguard_manager (port-only) called
   _restart_container immediately in apply_config, bypassing the pending
   restart banner and restarting the container before the docker port
   binding in .env was updated — leaving the service broken until the
   banner was applied manually. apply_config now only updates the config
   file (radicale.conf / wg0.conf); the docker compose restart happens
   via the banner as intended.

2. Port change detection in update_config used `if old_val is not None`
   to guard against triggering on unchanged values. When a service's port
   was never explicitly saved (first time), old_val was None, so the
   pending restart was never queued. Fix: fall back to PORT_DEFAULTS[key]
   so the comparison is always against the effective current value.

Add TestPortChangeDetection (5 tests) covering first-save and multi-service
accumulation cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -538,11 +538,13 @@ def update_config():
         port_changed_containers = set()
         port_change_messages = []
 
+        import ip_utils as _ip_utils_pcd
         for (svc_key, field), (_env_key, containers) in _PORT_CHANGE_MAP.items():
             if svc_key in data and field in data[svc_key]:
-                old_val = old_svc_configs.get(svc_key, {}).get(field)
+                default_val = _ip_utils_pcd.PORT_DEFAULTS.get(_env_key)
+                old_val = old_svc_configs.get(svc_key, {}).get(field, default_val)
                 new_val = data[svc_key][field]
-                if old_val is not None and old_val != new_val:
+                if old_val != new_val:
                     port_changed_containers.update(containers)
                     port_change_messages.append(
                         f'{svc_key} {field}: {old_val} → {new_val}'
@@ -550,9 +552,9 @@ def update_config():
 
         # wireguard_port in identity also drives WG_PORT env var; sync to service config
         if 'wireguard_port' in identity_updates:
-            old_wg = old_identity.get('wireguard_port')
+            old_wg = old_identity.get('wireguard_port', _ip_utils_pcd.PORT_DEFAULTS.get('wg_port', 51820))
             new_wg = identity_updates['wireguard_port']
-            if old_wg is not None and old_wg != new_wg:
+            if old_wg != new_wg:
                 # Sync to wireguard service config and update wg0.conf
                 _wg_svc = config_manager.configs.get('wireguard', {})
                 _wg_svc['port'] = new_wg