feat: Settings changes now apply to real service config files and restart containers

Each service manager now has apply_config() that writes to the actual config:
- network: dhcp_range → dnsmasq.conf (reload cell-dhcp), ntp_servers → chrony.conf
  (restart cell-ntp), domain → dnsmasq.conf domain= line
- email: domain → mailserver.env OVERRIDE_HOSTNAME + POSTMASTER_ADDRESS,
  restart cell-mail
- wireguard: port/address/private_key → wg0.conf ListenPort/Address/PrivateKey,
  restart cell-wireguard
- calendar: port → radicale config hosts=, restart cell-radicale

PUT /api/config now calls apply_config() after persisting JSON, and returns
{restarted: [...], warnings: [...]} so Settings UI can show which containers
were restarted. _restart_container() helper added to BaseServiceManager.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -414,21 +414,37 @@ def update_config():
             'vault': app.vault_manager,
         }
 
-        # Update service configurations in both config_manager and service managers
+        all_restarted = []
+        all_warnings = []
+
+        # Update service configurations: persist + apply to real config files
         for service, config in data.items():
             if service in config_manager.service_schemas:
                 config_manager.update_service_config(service, config)
-                # Propagate to the service manager's own config file
                 mgr = _svc_managers.get(service)
                 if mgr:
                     mgr.update_config(config)
+                    result = mgr.apply_config(config)
+                    all_restarted.extend(result.get('restarted', []))
+                    all_warnings.extend(result.get('warnings', []))
                 service_bus.publish_event(EventType.CONFIG_CHANGED, service, {
                     'service': service,
                     'config': config
                 })
 
-        logger.info(f"Updated config: {data}")
-        return jsonify({"message": "Configuration updated successfully"})
+        # Apply cell identity domain to network and email services
+        if identity_updates.get('domain'):
+            domain = identity_updates['domain']
+            net_result = network_manager.apply_domain(domain)
+            all_restarted.extend(net_result.get('restarted', []))
+            all_warnings.extend(net_result.get('warnings', []))
+
+        logger.info(f"Updated config, restarted: {all_restarted}")
+        return jsonify({
+            "message": "Configuration updated and applied",
+            "restarted": all_restarted,
+            "warnings": all_warnings,
+        })
     except Exception as e:
         logger.error(f"Error updating config: {e}")
         return jsonify({"error": str(e)}), 500