fix: consolidate WireGuard port config and propagate port changes to UI

- docker-compose: fix WireGuard port mapping to ${WG_PORT}:${WG_PORT} so
  the daemon ListenPort matches the Docker host-to-container binding
- app.py: sync wireguard.port ↔ identity.wireguard_port in both directions
  so changing either keeps them consistent; identity path now also updates
  wg0.conf via wireguard_manager.update_config
- Settings.jsx: remove duplicate wireguard_port from Cell Identity section
  (port is configurable under WireGuard VPN service config); add
  refreshConfig() after saveService so other pages see new values immediately
- WireGuard.jsx: import useConfig() and use service_configs.wireguard.port
  as the reactive port source for endpoint display and port-open warnings

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -474,6 +474,12 @@ def update_config():
                     n = len(peer_registry.list_peers())
                     if n:
                         all_warnings.append(f'WireGuard endpoint changed — {n} peer(s) must reinstall VPN config')
+                    # Keep identity.wireguard_port in sync with service config port
+                    if 'port' in config:
+                        _id = config_manager.configs.get('_identity', {})
+                        _id['wireguard_port'] = config['port']
+                        config_manager.configs['_identity'] = _id
+                        config_manager._save_all_configs()
 
         # Apply cell identity domain to network and email services
         if identity_updates.get('domain'):
@@ -542,11 +548,16 @@ def update_config():
                         f'{svc_key} {field}: {old_val} → {new_val}'
                     )
 
-        # wireguard_port in identity also drives WG_PORT env var
+        # wireguard_port in identity also drives WG_PORT env var; sync to service config
         if 'wireguard_port' in identity_updates:
             old_wg = old_identity.get('wireguard_port')
             new_wg = identity_updates['wireguard_port']
             if old_wg is not None and old_wg != new_wg:
+                # Sync to wireguard service config and update wg0.conf
+                _wg_svc = config_manager.configs.get('wireguard', {})
+                _wg_svc['port'] = new_wg
+                config_manager.update_service_config('wireguard', _wg_svc)
+                wireguard_manager.update_config({'port': new_wg})
                 port_changed_containers.add('wireguard')
                 port_change_messages.append(f'wireguard_port: {old_wg} → {new_wg}')