fix: DDNS update token in body, webdav gating, regression tests

- PicNgoDDNS.update(): send token in request body instead of Authorization
  header; DDNS server validates it from body (was returning HTTP 422 on
  every heartbeat, leaving IP record stale after fresh install)
- peers.py / Peers.jsx: webdav service_access only valid when 'files' store
  service is installed; was always shown even with no services, confusing
  users into thinking WebDAV was pre-installed
- 10 new regression tests: DDNS update body contract, Caddy always
  regenerates on startup with no services, peer role allowed on
  /api/services/active, webdav gating by installed services

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/ddns_manager.py

@@ -132,9 +132,10 @@ class PicNgoDDNS(DDNSProvider):
     def update(self, token: str, ip: str) -> bool:
         """PUT /api/v1/update — update A record."""
         url = f'{self.api_base_url}/api/v1/update'
-        payload = {'ip': ip}
+        # DDNS server validates token from request body, not Authorization header
+        payload = {'ip': ip, 'token': token}
         resp = requests.put(url, json=payload,
-                            headers=self._headers(token), timeout=self.TIMEOUT)
+                            headers=self._headers(), timeout=self.TIMEOUT)
         self._raise_for_status(resp, 'update')
         return True
 

api/routes/peers.py

@@ -65,9 +65,13 @@ def add_peer():
         except ValueError as e:
             return jsonify({'error': str(e)}), 409
 
+        # 'webdav' is part of the 'files' store service (same container set);
+        # expose it only when 'files' is installed.
         _STORE_ID_TO_ACCESS = {'email': 'mail', 'calendar': 'calendar', 'files': 'files'}
         _installed = set(_app_cfg.get_installed_services() or {})
-        _valid_services = {'webdav'} | {_STORE_ID_TO_ACCESS[sid] for sid in _installed if sid in _STORE_ID_TO_ACCESS}
+        _valid_services = {_STORE_ID_TO_ACCESS[sid] for sid in _installed if sid in _STORE_ID_TO_ACCESS}
+        if 'files' in _installed:
+            _valid_services.add('webdav')
         service_access = data.get('service_access', list(_valid_services))
         if not isinstance(service_access, list) or not all(s in _valid_services for s in service_access):
             return jsonify({"error": f"service_access must be a list of: {sorted(_valid_services)}"}), 400