feat: fix cross-cell service access — DNS DNAT, service DNAT, Caddy routing

DNS A records now return the WireGuard server IP (10.0.0.1) instead of
Docker bridge VIPs so cross-cell peers resolve service names correctly
regardless of their bridge subnet. DNAT rules (wg0:53→cell-dns:53 and
wg0:80→cell-caddy:80) are applied at startup. Caddy routes by Host header,
eliminating the Docker bridge subnet conflict. Firewall cell rules allow
DNS and service (Caddy) traffic from linked cell subnets. Split-tunnel
AllowedIPs now dynamically includes connected-cell VPN subnets and drops
the 172.20.0.0/16 range. Peers with route_via set now receive full-tunnel
config (0.0.0.0/0) so all their traffic exits via the remote cell.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routes/peer_dashboard.py

@@ -77,7 +77,9 @@ def peer_services():
         if peer_private_key:
             try:
                 internet_access = peer.get('internet_access', True)
-                allowed_ips = wireguard_manager.FULL_TUNNEL_IPS if internet_access else wireguard_manager.get_split_tunnel_ips()
+                route_via = peer.get('route_via')
+                use_full = internet_access or bool(route_via)
+                allowed_ips = wireguard_manager.FULL_TUNNEL_IPS if use_full else wireguard_manager.get_split_tunnel_ips()
                 wg_config = wireguard_manager.get_peer_config(
                     peer_name=peer_name,
                     peer_ip=peer_ip,

api/routes/wireguard.py

@@ -176,7 +176,11 @@ def get_peer_config():
         allowed_ips = data.get('allowed_ips') or None
         if not allowed_ips and registered:
             internet_access = registered.get('internet_access', True)
-            allowed_ips = wireguard_manager.FULL_TUNNEL_IPS if internet_access else wireguard_manager.get_split_tunnel_ips()
+            route_via = registered.get('route_via')
+            # Full tunnel when internet is allowed OR when route_via is set
+            # (route_via exits via a remote cell — all traffic must go through the tunnel)
+            use_full = internet_access or bool(route_via)
+            allowed_ips = wireguard_manager.FULL_TUNNEL_IPS if use_full else wireguard_manager.get_split_tunnel_ips()
 
         result = wireguard_manager.get_peer_config(
             peer_name=peer_name,