fix: WireGuard peer sync, privileged mode, E2E and integration test correctness

- api/app.py: sync WireGuard server config on peer add/remove (non-fatal)
- docker-compose.yml: add privileged:true to wireguard service
- E2E tests: fix logout selector, DNS IP lookup, wg config DNS line, VIP skip guards,
  badge text selectors, heading .first, async logout wait
- Integration tests: fix 4 tests that sent unauthenticated requests expecting 400
  (now use authenticated session helpers); accept 401 as valid in webui proxy test;
  add password field to service_access validation test
- Remove stale tracked config templates (config/api/api/*, config/api/cell.env, etc.)
  that no longer exist on disk after config layout was reorganised

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/integration/test_webui.py

@@ -45,6 +45,6 @@ class TestWebUIServing:
         # Verify the API is accessible (CORS / proxy config working)
         r = requests.get(f"{WEBUI_BASE.rstrip('/')}/api/status".replace(
             f':{80}', '').replace('///', '//'))
-        # The webui container proxies /api → cell-api, so this should work
-        # If not proxied, it might 404 — either way it shouldn't be a connection error
-        assert r.status_code in (200, 404, 301, 302)
+        # The webui container proxies /api → cell-api, so this should work.
+        # 401 means the API is reachable but requires auth — that's fine here.
+        assert r.status_code in (200, 401, 404, 301, 302)