fix: port changes now correctly queue pending restart for all services

Two bugs fixed:

1. calendar_manager and wireguard_manager (port-only) called
   _restart_container immediately in apply_config, bypassing the pending
   restart banner and restarting the container before the docker port
   binding in .env was updated — leaving the service broken until the
   banner was applied manually. apply_config now only updates the config
   file (radicale.conf / wg0.conf); the docker compose restart happens
   via the banner as intended.

2. Port change detection in update_config used `if old_val is not None`
   to guard against triggering on unchanged values. When a service's port
   was never explicitly saved (first time), old_val was None, so the
   pending restart was never queued. Fix: fall back to PORT_DEFAULTS[key]
   so the comparison is always against the effective current value.

Add TestPortChangeDetection (5 tests) covering first-save and multi-service
accumulation cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/wireguard_manager.py

@@ -225,21 +225,27 @@ class WireGuardManager(BaseServiceManager):
                 return result
 
             changed = False
+            port_only_change = True
             if 'port' in config and config['port']:
                 lines = _set_iface_field(lines, 'ListenPort', config['port'])
                 changed = True
             if 'address' in config and config['address']:
                 lines = _set_iface_field(lines, 'Address', config['address'])
                 changed = True
+                port_only_change = False
             if 'private_key' in config and config['private_key']:
                 lines = _set_iface_field(lines, 'PrivateKey', config['private_key'])
                 changed = True
+                port_only_change = False
 
             if changed:
                 with open(cf, 'w') as f:
                     f.writelines(lines)
-                self._restart_container('cell-wireguard')
-                restarted.append('cell-wireguard')
+                # Port-only changes: docker binding must be updated first via pending restart.
+                # Non-port changes (address, private_key) can restart immediately.
+                if not port_only_change:
+                    self._restart_container('cell-wireguard')
+                    restarted.append('cell-wireguard')
         except Exception as e:
             warnings.append(f"wg0.conf update failed: {e}")
             logger.error(f"apply_config error: {e}")