wire: AccountManager HTTP dispatch + EgressManager startup + egress API routes

- add_peer() now calls account_manager.provision() for any installed store
  service whose manifest declares accounts.manager == 'http', enabling
  per-peer credential provisioning to third-party HTTP services
- reapply_on_startup() calls egress_manager.apply_all() so fwmark rules
  survive container restarts without manual intervention
- add GET /api/egress/status and PUT /api/egress/services/<id>/exit routes
  so the UI can read and override per-service egress policy
- tests: HTTP provision wiring (happy path + non-fatal failure), egress
  apply_all at startup (wired/unwired/failure cases)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/service_store_manager.py

@@ -436,3 +436,10 @@ class ServiceStoreManager(BaseServiceManager):
                 self.service_composer.reapply_active_services()
             except Exception as e:
                 logger.warning('reapply_on_startup: reapply_active_services failed: %s', e)
+
+        # Re-apply egress fwmark rules
+        if self.egress_manager is not None:
+            try:
+                self.egress_manager.apply_all()
+            except Exception as e:
+                logger.warning('reapply_on_startup: egress apply_all failed: %s', e)