fix: WireGuard peer sync, privileged mode, E2E and integration test correctness

- api/app.py: sync WireGuard server config on peer add/remove (non-fatal)
- docker-compose.yml: add privileged:true to wireguard service
- E2E tests: fix logout selector, DNS IP lookup, wg config DNS line, VIP skip guards,
  badge text selectors, heading .first, async logout wait
- Integration tests: fix 4 tests that sent unauthenticated requests expecting 400
  (now use authenticated session helpers); accept 401 as valid in webui proxy test;
  add password field to service_access validation test
- Remove stale tracked config templates (config/api/api/*, config/api/cell.env, etc.)
  that no longer exist on disk after config layout was reorganised

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/e2e/ui/test_admin_wireguard.py

@@ -136,16 +136,17 @@ def test_wireguard_port_check_badge_renders(admin_page, webui_base):
     page.wait_for_load_state('networkidle')
 
     try:
-        # Wait for the server config section to appear
-        page.wait_for_selector('text=Server Configuration', timeout=10000)
+        # Wait for the server endpoint section to appear
+        page.wait_for_selector('h2:has-text("Server Endpoint")', timeout=10000)
 
-        # Port badge — any of the four possible states is acceptable
-        badge = page.locator('span', has_text='Open').or_(
-            page.locator('span', has_text='Blocked')
+        # Port badge — any of the four possible states is acceptable.
+        # Use get_by_text with exact=True to avoid matching sr-only "Open sidebar".
+        badge = page.get_by_text('Open', exact=True).or_(
+            page.get_by_text('Blocked', exact=True)
         ).or_(
-            page.locator('span', has_text='Checking')
+            page.get_by_text('Checking…', exact=True)
         ).or_(
-            page.locator('span', has_text='Click Refresh IP')
+            page.get_by_text('Click Refresh IP to check', exact=True)
         ).first
         badge.wait_for(timeout=15000)
         assert badge.is_visible(), "Port status badge not visible on WireGuard page"