wire: AccountManager HTTP dispatch + EgressManager startup + egress API routes

- add_peer() now calls account_manager.provision() for any installed store
  service whose manifest declares accounts.manager == 'http', enabling
  per-peer credential provisioning to third-party HTTP services
- reapply_on_startup() calls egress_manager.apply_all() so fwmark rules
  survive container restarts without manual intervention
- add GET /api/egress/status and PUT /api/egress/services/<id>/exit routes
  so the UI can read and override per-service egress policy
- tests: HTTP provision wiring (happy path + non-fatal failure), egress
  apply_all at startup (wired/unwired/failure cases)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routes/peers.py

@@ -89,6 +89,20 @@ def add_peer():
             except Exception as e:
                 logger.warning(f"Peer {peer_name}: {step_name} account creation failed (non-fatal): {e}")
 
+        # Provision accounts for installed HTTP-backed store services (non-fatal)
+        try:
+            from app import account_manager as _am, config_manager as _cfg, service_registry as _sreg
+            for _svc_id in (_cfg.get_installed_services() or {}):
+                _svc_info = _sreg.get(_svc_id)
+                if _svc_info and (_svc_info.get('accounts') or {}).get('manager') == 'http':
+                    try:
+                        _am.provision(_svc_id, peer_name)
+                    except Exception as _he:
+                        logger.warning('Peer %s: HTTP account provision for %s failed (non-fatal): %s',
+                                       peer_name, _svc_id, _he)
+        except Exception as _am_err:
+            logger.warning('Peer %s: HTTP store provisioning failed (non-fatal): %s', peer_name, _am_err)
+
         peer_info = {
             'peer': peer_name,
             'ip': assigned_ip,