feat: WireGuard endpoint override + fix Docker network label issue

Endpoint override:
- Add PUT /api/wireguard/endpoint to set endpoint_override in identity
  config; GET returns detected, override, and effective endpoints
- _effective_endpoint() helper applies override in peer config generation
  (wireguard.py and peer_dashboard.py); detected IP still shown in UI
- Add Endpoint Override input in WireGuard page — solves the common case
  where auto-detected IP is a gateway/VPS but peers connect via LAN IP

Docker cell-network fix:
- Declare cell-network external in docker-compose.yml; Docker Compose v5
  enforces label ownership and rejects networks created by older versions
- Makefile start/update pre-create cell-network idempotently
- reinstall/uninstall(full) explicitly delete and recreate the network
- Fix uninstall loop path: data/api/services/ (not data/services/)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

webui/src/services/api.js

@@ -137,6 +137,8 @@ export const wireguardAPI = {
   updatePeerIP: (data) => api.put('/api/wireguard/peers/ip', data),
   getPeerConfig: (data) => api.post('/api/wireguard/peers/config', data),
   getPeerStatuses: () => api.get('/api/wireguard/peers/statuses'),
+  getEndpoint: () => api.get('/api/wireguard/endpoint'),
+  setEndpointOverride: (endpoint_override) => api.put('/api/wireguard/endpoint', { endpoint_override }),
 };
 
 // Peer Registry API