fix: WireGuard peer sync, privileged mode, E2E and integration test correctness

- api/app.py: sync WireGuard server config on peer add/remove (non-fatal)
- docker-compose.yml: add privileged:true to wireguard service
- E2E tests: fix logout selector, DNS IP lookup, wg config DNS line, VIP skip guards,
  badge text selectors, heading .first, async logout wait
- Integration tests: fix 4 tests that sent unauthenticated requests expecting 400
  (now use authenticated session helpers); accept 401 as valid in webui proxy test;
  add password field to service_access validation test
- Remove stale tracked config templates (config/api/api/*, config/api/cell.env, etc.)
  that no longer exist on disk after config layout was reorganised

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/e2e/helpers/wg_runner.py

@@ -33,12 +33,16 @@ class WGInterface:
 def build_wg_config(private_key: str, peer_ip: str, server_pubkey: str,
                      server_endpoint: str, server_port: int = 51820,
                      allowed_ips: str = '10.0.0.0/24',
-                     dns: str = '10.0.0.1') -> str:
+                     dns: str = None) -> str:
+    # Omit DNS line by default — wg-quick would try to call resolvconf/systemd-resolved
+    # to set system DNS, which is not installed in all test environments.
+    # DNS tests reach 10.0.0.1 directly via `dig @10.0.0.1` once the tunnel is up.
+    dns_line = f"DNS = {dns}\n" if dns else ""
     return (
         f"[Interface]\n"
         f"PrivateKey = {private_key}\n"
         f"Address = {peer_ip}/32\n"
-        f"DNS = {dns}\n\n"
+        f"{dns_line}\n"
         f"[Peer]\n"
         f"PublicKey = {server_pubkey}\n"
         f"Endpoint = {server_endpoint}:{server_port}\n"