fix: WireGuard peer sync, privileged mode, E2E and integration test correctness

- api/app.py: sync WireGuard server config on peer add/remove (non-fatal)
- docker-compose.yml: add privileged:true to wireguard service
- E2E tests: fix logout selector, DNS IP lookup, wg config DNS line, VIP skip guards,
  badge text selectors, heading .first, async logout wait
- Integration tests: fix 4 tests that sent unauthenticated requests expecting 400
  (now use authenticated session helpers); accept 401 as valid in webui proxy test;
  add password field to service_access validation test
- Remove stale tracked config templates (config/api/api/*, config/api/cell.env, etc.)
  that no longer exist on disk after config layout was reorganised

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/e2e/helpers/playwright_login.py

@@ -13,7 +13,7 @@ def do_login(page: Page, webui_base: str, username: str, password: str):
 
 def do_logout(page: Page, webui_base: str):
     """Click the 'Sign out' button in the desktop sidebar and wait for redirect to /login."""
-    # The desktop sidebar renders a button with text "Sign out"; the mobile sidebar
-    # also has one.  Use first() to avoid a strict-mode error when both are mounted.
-    page.locator('button:has-text("Sign out")').first.click()
+    # Desktop sidebar button has title="Sign out"; mobile button has no title.
+    # This avoids clicking the hidden mobile sidebar button when both are in the DOM.
+    page.locator('button[title="Sign out"]').click()
     page.wait_for_url(lambda url: '/login' in url, timeout=5000)