fix: use effective_domain for service links and clean up stale DNS records

Dashboard, Email, Calendar, and Files pages were building service URLs
with the internal LAN zone name (e.g. 'cell') instead of the public
effective domain (e.g. 'pic2.pic.ngo'), and always using http:// even
in DDNS mode where HTTPS is available.

Changes:
- Dashboard/Email/Calendar/Files: read effective_domain + domain_mode
  from ConfigContext; use effective_domain in non-LAN mode and https://
  for all DDNS domain modes.
- Calendar: show port 443 instead of 80 in DDNS mode.
- network_manager.update_split_horizon_zone: when the primary internal
  zone name is a parent of the effective DDNS domain (e.g. pic.ngo is a
  parent of pic2.pic.ngo), remove stale bootstrap service records (api,
  calendar, files, mail, webmail, webdav) that pollute the DNS display
  and would shadow public DNS responses.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/network_manager.py

@@ -182,6 +182,18 @@ class NetworkManager(BaseServiceManager):
         if not ok:
             logger.warning('update_split_horizon_zone: zone file write failed for %s', effective_domain)
 
+        # If the internal zone name happens to be a parent of the effective DDNS
+        # domain (e.g. primary_domain='pic.ngo', effective_domain='pic2.pic.ngo'),
+        # bootstrap service records like 'api', 'calendar' etc. would pollute the
+        # zone display and shadow the public domain.  Remove them.
+        _stale = {'api', 'webui', 'calendar', 'files', 'mail', 'webmail', 'webdav'}
+        if effective_domain.endswith('.' + primary_domain):
+            existing = self._load_dns_records(primary_domain)
+            cleaned = [r for r in existing if r.get('name', '') not in _stale]
+            if len(cleaned) < len(existing):
+                self.update_dns_zone(primary_domain, cleaned)
+                logger.info('Removed stale service records from zone %s', primary_domain)
+
         corefile = os.path.join(self.config_dir, 'dns', 'Corefile')
         peers_data = peers or []
         ok_cf = _fm.generate_corefile(