feat: connectivity — registry-driven peer table, sshuttle/proxy egress, egress UI

The peer table was empty because it was not consulting the peer registry;
now peers are driven by PeerRegistry so the Connectivity page reflects actual
connected cells.

Exit-key handling is unified: all code paths now use the same key derivation
so a store-service exit bridge and a manual WireGuard peer both produce
consistent routing state.

Two new egress exit types are added (sshuttle via SSH tunnel and proxy via
redsocks SOCKS5), wiring through connectivity_manager, egress_manager, and
app.py routes. This lets a cell route its traffic through an SSH host or a
SOCKS5 proxy as an alternative to WireGuard exit nodes.

ServiceStoreManager and ServiceBus updated so the egress lifecycle (install /
uninstall) is cleanly signalled between components.

Connectivity.jsx gains the Service Egress section, letting operators assign
and reassign egress methods from the UI without touching config files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

api/service_bus.py

@@ -186,7 +186,7 @@ class ServiceBus:
                 'email': ['cell-mail', 'cell-rainloop'],  # Email service includes both mail server and web client
                 'calendar': ['cell-radicale'],
                 'files': ['cell-webdav', 'cell-filegator'],  # Files service includes both webdav and file manager
-                'network': ['cell-dns', 'cell-dhcp', 'cell-ntp'],  # Network service includes all network components
+                'network': ['cell-dns', 'cell-ntp'],  # Network service includes all network components
                 'routing': None,  # Routing is a system service, not a container
                 'vault': None,  # Vault is part of API, not a separate container
                 'container': None  # Container manager doesn't have its own container
@@ -237,7 +237,7 @@ class ServiceBus:
                 'email': ['cell-mail', 'cell-rainloop'],  # Email service includes both mail server and web client
                 'calendar': ['cell-radicale'],
                 'files': ['cell-webdav', 'cell-filegator'],  # Files service includes both webdav and file manager
-                'network': ['cell-dns', 'cell-dhcp', 'cell-ntp'],  # Network service includes all network components
+                'network': ['cell-dns', 'cell-ntp'],  # Network service includes all network components
                 'routing': None,  # Routing is a system service, not a container
                 'vault': None,  # Vault is part of API, not a separate container
                 'container': None  # Container manager doesn't have its own container