feat: peer access config, DNS fix, real routing table, reinstall notifications

Peer creation/edit form now configures:
- Tunnel mode: full (0.0.0.0/0) or split (PIC only)
- Per-service access toggles (calendar, files, mail, webdav)
- Peer-to-peer communication toggle
- Optional calendar account creation
- Access capability badges in peer list

Bug fixes:
- DNS in client configs was 8.8.8.8 / 172.20.0.2 — now 172.20.0.3 (CoreDNS)
  This was why .cell domains didn't resolve on connected VPN peers
- get_peer_config API uses stored internet_access to set AllowedIPs
- New PUT /api/peers/<name> endpoint with config_changed detection
- POST /api/peers/<name>/clear-reinstall clears reinstall flag after download
- Routing page reads real host routes via /proc/1/net/route (pid: host)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

webui/src/pages/WireGuard.jsx

@@ -181,7 +181,7 @@ function WireGuard() {
     return { public_key: '', endpoint: '<SERVER_IP>:51820' };
   };
 
-  const CELL_DNS = '172.20.0.2';
+  const CELL_DNS = '172.20.0.3';
   const SPLIT_TUNNEL_IPS = '10.0.0.0/24, 172.20.0.0/16';
   const FULL_TUNNEL_IPS = '0.0.0.0/0, ::/0';