wire: AccountManager HTTP dispatch + EgressManager startup + egress API routes

- add_peer() now calls account_manager.provision() for any installed store
  service whose manifest declares accounts.manager == 'http', enabling
  per-peer credential provisioning to third-party HTTP services
- reapply_on_startup() calls egress_manager.apply_all() so fwmark rules
  survive container restarts without manual intervention
- add GET /api/egress/status and PUT /api/egress/services/<id>/exit routes
  so the UI can read and override per-service egress policy
- tests: HTTP provision wiring (happy path + non-fatal failure), egress
  apply_all at startup (wired/unwired/failure cases)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -854,6 +854,33 @@ def connectivity_get_peer_exits():
         return jsonify({'error': str(e)}), 500
 
 
+@app.route('/api/egress/status', methods=['GET'])
+def egress_status():
+    """Return egress status for all installed services that have an egress config."""
+    try:
+        return jsonify(egress_manager.get_status())
+    except Exception as e:
+        logger.error(f"egress_status: {e}")
+        return jsonify({'error': str(e)}), 500
+
+
+@app.route('/api/egress/services/<service_id>/exit', methods=['PUT'])
+def egress_set_service_exit(service_id: str):
+    """Persist and immediately apply a per-service egress override."""
+    try:
+        data = request.get_json(silent=True) or {}
+        exit_type = data.get('exit_type')
+        if not isinstance(exit_type, str):
+            return jsonify({'ok': False, 'error': 'exit_type is required'}), 400
+        result = egress_manager.set_service_exit(service_id, exit_type)
+        if result.get('ok'):
+            return jsonify(result)
+        return jsonify(result), 400
+    except Exception as e:
+        logger.error(f"egress_set_service_exit({service_id}): {e}")
+        return jsonify({'error': str(e)}), 500
+
+
 if __name__ == '__main__':
     debug = os.environ.get('FLASK_DEBUG', '0') == '1'
     app.run(host='0.0.0.0', port=3000, debug=debug)