fix: WireGuard peer sync, privileged mode, E2E and integration test correctness

- api/app.py: sync WireGuard server config on peer add/remove (non-fatal)
- docker-compose.yml: add privileged:true to wireguard service
- E2E tests: fix logout selector, DNS IP lookup, wg config DNS line, VIP skip guards,
  badge text selectors, heading .first, async logout wait
- Integration tests: fix 4 tests that sent unauthenticated requests expecting 400
  (now use authenticated session helpers); accept 401 as valid in webui proxy test;
  add password field to service_access validation test
- Remove stale tracked config templates (config/api/api/*, config/api/cell.env, etc.)
  that no longer exist on disk after config layout was reorganised

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -1884,6 +1884,12 @@ def add_peer():
 
         success = peer_registry.add_peer(peer_info)
         if success:
+            # Add peer to WireGuard server config (non-fatal if WG is not running)
+            wg_allowed = f"{assigned_ip}/32" if '/' not in assigned_ip else assigned_ip
+            try:
+                wireguard_manager.add_peer(peer_name, data['public_key'], endpoint_ip='', allowed_ips=wg_allowed)
+            except Exception as wg_err:
+                logger.warning(f"Peer {peer_name}: WireGuard server config update failed (non-fatal): {wg_err}")
             # Apply server-side enforcement immediately
             firewall_manager.apply_peer_rules(peer_info['ip'], peer_info)
             firewall_manager.apply_all_dns_rules(peer_registry.list_peers(), COREFILE_PATH, _configured_domain())
@@ -1963,11 +1969,18 @@ def remove_peer(peer_name):
         if not peer:
             return jsonify({"message": f"Peer {peer_name} not found or already removed"})
         peer_ip = peer.get('ip')
+        peer_pubkey = peer.get('public_key', '')
         success = peer_registry.remove_peer(peer_name)
         if success:
             if peer_ip:
                 firewall_manager.clear_peer_rules(peer_ip)
             firewall_manager.apply_all_dns_rules(peer_registry.list_peers(), COREFILE_PATH, _configured_domain())
+            # Remove peer from WireGuard server config (non-fatal)
+            if peer_pubkey:
+                try:
+                    wireguard_manager.remove_peer(peer_pubkey)
+                except Exception as wg_err:
+                    logger.warning(f"Peer {peer_name}: WireGuard removal failed (non-fatal): {wg_err}")
         # Clean up all provisioned service accounts (best-effort)
         for _cleanup in [
             lambda: email_manager.delete_email_user(peer_name),