fix: WireGuard peer sync, privileged mode, E2E and integration test correctness

- api/app.py: sync WireGuard server config on peer add/remove (non-fatal)
- docker-compose.yml: add privileged:true to wireguard service
- E2E tests: fix logout selector, DNS IP lookup, wg config DNS line, VIP skip guards,
  badge text selectors, heading .first, async logout wait
- Integration tests: fix 4 tests that sent unauthenticated requests expecting 400
  (now use authenticated session helpers); accept 401 as valid in webui proxy test;
  add password field to service_access validation test
- Remove stale tracked config templates (config/api/api/*, config/api/cell.env, etc.)
  that no longer exist on disk after config layout was reorganised

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/integration/test_network_services.py

@@ -178,11 +178,7 @@ class TestDhcpReservations:
         assert 'error' in r.json()
 
     def test_add_dhcp_reservation_empty_body_returns_400(self):
-        r = requests.post(
-            f"{API_BASE}/api/dhcp/reservations",
-            data='',
-            headers={'Content-Type': 'application/json'},
-        )
+        r = post('/api/dhcp/reservations', data='')
         assert r.status_code == 400
 
     def test_delete_dhcp_reservation_missing_mac_returns_400(self):