fix: DDNS update token in body, webdav gating, regression tests

- PicNgoDDNS.update(): send token in request body instead of Authorization
  header; DDNS server validates it from body (was returning HTTP 422 on
  every heartbeat, leaving IP record stale after fresh install)
- peers.py / Peers.jsx: webdav service_access only valid when 'files' store
  service is installed; was always shown even with no services, confusing
  users into thinking WebDAV was pre-installed
- 10 new regression tests: DDNS update body contract, Caddy always
  regenerates on startup with no services, peer role allowed on
  /api/services/active, webdav gating by installed services

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/ddns_manager.py

@@ -132,9 +132,10 @@ class PicNgoDDNS(DDNSProvider):
     def update(self, token: str, ip: str) -> bool:
         """PUT /api/v1/update — update A record."""
         url = f'{self.api_base_url}/api/v1/update'
-        payload = {'ip': ip}
+        # DDNS server validates token from request body, not Authorization header
+        payload = {'ip': ip, 'token': token}
         resp = requests.put(url, json=payload,
-                            headers=self._headers(token), timeout=self.TIMEOUT)
+                            headers=self._headers(), timeout=self.TIMEOUT)
         self._raise_for_status(resp, 'update')
         return True