feat: WireGuard endpoint override + fix Docker network label issue

Endpoint override:
- Add PUT /api/wireguard/endpoint to set endpoint_override in identity
  config; GET returns detected, override, and effective endpoints
- _effective_endpoint() helper applies override in peer config generation
  (wireguard.py and peer_dashboard.py); detected IP still shown in UI
- Add Endpoint Override input in WireGuard page — solves the common case
  where auto-detected IP is a gateway/VPS but peers connect via LAN IP

Docker cell-network fix:
- Declare cell-network external in docker-compose.yml; Docker Compose v5
  enforces label ownership and rejects networks created by older versions
- Makefile start/update pre-create cell-network idempotently
- reinstall/uninstall(full) explicitly delete and recreate the network
- Fix uninstall loop path: data/api/services/ (not data/services/)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routes/peer_dashboard.py

@@ -65,10 +65,11 @@ def peer_services():
         wg_port = 51820
         server_endpoint = ''
         try:
+            from routes.wireguard import _effective_endpoint
+            from app import config_manager
             server_public_key = wireguard_manager.get_keys().get('public_key', '')
             wg_port = config_manager.configs.get('_identity', {}).get('wireguard_port', 51820)
-            srv = wireguard_manager.get_server_config()
-            server_endpoint = srv.get('endpoint') or '<SERVER_IP>'
+            server_endpoint = _effective_endpoint(wireguard_manager, config_manager)
         except Exception:
             pass