fix: WireGuard peer sync, privileged mode, E2E and integration test correctness

- api/app.py: sync WireGuard server config on peer add/remove (non-fatal)
- docker-compose.yml: add privileged:true to wireguard service
- E2E tests: fix logout selector, DNS IP lookup, wg config DNS line, VIP skip guards,
  badge text selectors, heading .first, async logout wait
- Integration tests: fix 4 tests that sent unauthenticated requests expecting 400
  (now use authenticated session helpers); accept 401 as valid in webui proxy test;
  add password field to service_access validation test
- Remove stale tracked config templates (config/api/api/*, config/api/cell.env, etc.)
  that no longer exist on disk after config layout was reorganised

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/e2e/ui/test_admin_login.py

@@ -35,10 +35,10 @@ def test_login_success_shows_dashboard_heading(page, webui_base, admin_user, adm
     page.click('button[type="submit"]')
     page.wait_for_url(lambda url: '/login' not in url, timeout=10000)
     page.wait_for_load_state('networkidle')
-    # The sidebar always renders the app title; Dashboard heading is also present.
+    # The sidebar renders the app title twice (mobile + desktop); use first.
     assert (
-        page.locator('h1:has-text("Personal Internet Cell")').is_visible()
-        or page.locator('h1:has-text("Dashboard")').is_visible()
+        page.locator('h1:has-text("Personal Internet Cell")').first.is_visible()
+        or page.locator('h1:has-text("Dashboard")').first.is_visible()
     )
 
 
@@ -93,7 +93,11 @@ def test_logout_clears_session(admin_page, webui_base):
     from helpers.playwright_login import do_logout
     do_logout(page, webui_base)
     page.goto(f"{webui_base}/")
-    page.wait_for_load_state('networkidle')
+    # React auth check is async — wait for the redirect to /login
+    try:
+        page.wait_for_url(lambda url: '/login' in url, timeout=8000)
+    except Exception:
+        pass
     assert '/login' in page.url
 
 

tests/e2e/ui/test_admin_wireguard.py

@@ -136,16 +136,17 @@ def test_wireguard_port_check_badge_renders(admin_page, webui_base):
     page.wait_for_load_state('networkidle')
 
     try:
-        # Wait for the server config section to appear
-        page.wait_for_selector('text=Server Configuration', timeout=10000)
+        # Wait for the server endpoint section to appear
+        page.wait_for_selector('h2:has-text("Server Endpoint")', timeout=10000)
 
-        # Port badge — any of the four possible states is acceptable
-        badge = page.locator('span', has_text='Open').or_(
-            page.locator('span', has_text='Blocked')
+        # Port badge — any of the four possible states is acceptable.
+        # Use get_by_text with exact=True to avoid matching sr-only "Open sidebar".
+        badge = page.get_by_text('Open', exact=True).or_(
+            page.get_by_text('Blocked', exact=True)
         ).or_(
-            page.locator('span', has_text='Checking')
+            page.get_by_text('Checking…', exact=True)
         ).or_(
-            page.locator('span', has_text='Click Refresh IP')
+            page.get_by_text('Click Refresh IP to check', exact=True)
         ).first
         badge.wait_for(timeout=15000)
         assert badge.is_visible(), "Port status badge not visible on WireGuard page"