Fix: use domain_name as service URL base and harden WG e2e tests

API:
- _configured_domain() now prefers _identity.domain_name (full FQDN
  e.g. 'test5.pic.ngo') over domain ('pic.ngo'). Service URLs in
  /api/peer/services and /api/peer/dashboard now correctly return
  'calendar.test5.pic.ngo' instead of 'calendar.pic.ngo'.

WG e2e tests:
- test_api_domain_returns_json_not_webui: accept 3xx redirect as
  valid routing (Caddy redirects HTTP→HTTPS in pic_ngo mode).
- test_catchall_api_path_returns_json and test_catchall_root_serves_webui:
  skip when Caddy is in HTTPS-redirect mode — catch-all :80 block only
  exists in HTTP-mode cells (lan/local domain).
- test_http_api_domain_reaches_api: replace --dns-servers (requires
  c-ares) with dig + curl --host pattern.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -292,7 +292,10 @@ auth_routes.auth_manager = auth_manager
 
 # Apply firewall + DNS rules from stored peer settings (survives API restarts)
 def _configured_domain() -> str:
-    return config_manager.configs.get('_identity', {}).get('domain', 'cell')
+    identity = config_manager.configs.get('_identity', {})
+    # domain_name is the full FQDN (e.g. 'test5.pic.ngo'); fall back to domain
+    # (e.g. 'lan', 'dev') for cells that don't have a subdomain prefix.
+    return identity.get('domain_name') or identity.get('domain', 'cell')
 
 
 def _restore_cell_wg_peers(cell_links):