fix: WireGuard peer sync, privileged mode, E2E and integration test correctness

- api/app.py: sync WireGuard server config on peer add/remove (non-fatal)
- docker-compose.yml: add privileged:true to wireguard service
- E2E tests: fix logout selector, DNS IP lookup, wg config DNS line, VIP skip guards,
  badge text selectors, heading .first, async logout wait
- Integration tests: fix 4 tests that sent unauthenticated requests expecting 400
  (now use authenticated session helpers); accept 401 as valid in webui proxy test;
  add password field to service_access validation test
- Remove stale tracked config templates (config/api/api/*, config/api/cell.env, etc.)
  that no longer exist on disk after config layout was reorganised

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/e2e/ui/test_admin_login.py

@@ -35,10 +35,10 @@ def test_login_success_shows_dashboard_heading(page, webui_base, admin_user, adm
     page.click('button[type="submit"]')
     page.wait_for_url(lambda url: '/login' not in url, timeout=10000)
     page.wait_for_load_state('networkidle')
-    # The sidebar always renders the app title; Dashboard heading is also present.
+    # The sidebar renders the app title twice (mobile + desktop); use first.
     assert (
-        page.locator('h1:has-text("Personal Internet Cell")').is_visible()
-        or page.locator('h1:has-text("Dashboard")').is_visible()
+        page.locator('h1:has-text("Personal Internet Cell")').first.is_visible()
+        or page.locator('h1:has-text("Dashboard")').first.is_visible()
     )
 
 
@@ -93,7 +93,11 @@ def test_logout_clears_session(admin_page, webui_base):
     from helpers.playwright_login import do_logout
     do_logout(page, webui_base)
     page.goto(f"{webui_base}/")
-    page.wait_for_load_state('networkidle')
+    # React auth check is async — wait for the redirect to /login
+    try:
+        page.wait_for_url(lambda url: '/login' in url, timeout=8000)
+    except Exception:
+        pass
     assert '/login' in page.url