feat: connectivity redesign phase 7 — cell-relay as a connection type

cell exits surface as cell_relay connections via reconcile, bridged onto
the existing cell route_via mechanism, health from handshake, loop
detection, assignable in the unified UI

- CELL_RELAY_TYPE constant; not manually creatable
- reconcile_cell_relays() derives connections from cell links offering an
  exit (name "Cell: <cellname>", mark+table only, no iface/port/container)
- apply_routes bridges cell_relay to existing route_via path via
  apply_peer_route_via + cell firewall rules + set_exit_relay_active;
  keeps peer.route_via in sync
- _probe_cell_relay health from cell handshake + offer state
- _cell_relay_loops loop detection at assign and apply time
- FAILOPEN_DEFAULTS cell_relay=False
- set_peer_exit clears stale route_via on reassignment
- reconcile hooked into PUT /exit-offer and peer-sync/permissions handlers
- cell_link_manager + wireguard_manager wired into connectivity_manager
- UI: cell_relay in TYPE_META/GROUP_TYPES/GROUP_LABELS (Cells optgroup),
  removed "coming soon" placeholder
- 18 new tests in tests/test_connectivity_cell_relay.py

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

api/managers.py

@@ -100,6 +100,10 @@ service_composer = ServiceComposer(config_manager=config_manager, data_dir=DATA_
 # Connectivity brings one container up per connection instance via the composer;
 # wire it now that the composer exists (composer is built after connectivity).
 connectivity_manager.service_composer = service_composer
+# cell_relay connections are derived from cell links and route through the cell
+# WG tunnel; wire the managers that drive that path + handshake-based health.
+connectivity_manager.cell_link_manager = cell_link_manager
+connectivity_manager.wireguard_manager = wireguard_manager
 account_manager  = AccountManager(
     service_registry=service_registry,
     data_dir=DATA_DIR,