feat: Phase 4 — dynamic nav + service visibility based on installed services

Email, calendar, and files no longer appear in the nav or as usable pages
unless they are installed. The nav refreshes whenever a service is installed
or removed via the new pic-services-changed CustomEvent.

Changes:
- routes/services.py: add GET /api/services/active endpoint
- api.js: add servicesAPI.listActive()
- App.jsx: replace hardcoded coreServiceChildren with dynamic state fetched
  from /api/services/active; SERVICE_META maps ids to nav entry shapes
- ServiceNotInstalledBanner.jsx: new component — admin gets catalog link,
  peer gets "contact admin" message
- EmailPage/CalendarPage/FilesPage: show banner when service not installed
- ServicesIndex.jsx: remove CoreServiceCard + CORE_SERVICES "Built-in"
  section; rename Remove → Uninstall; dispatch pic-services-changed on
  install/uninstall success
- MyServices.jsx: conditionally render service cards based on active list;
  placeholder card when absent; page-level notice when nothing is installed
- tests/test_services_active_endpoint.py: 4 new endpoint tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

webui/src/services/api.js

@@ -271,6 +271,7 @@ export const servicesAPI = {
   startService: (serviceName) => api.post(`/api/services/bus/services/${serviceName}/start`),
   stopService: (serviceName) => api.post(`/api/services/bus/services/${serviceName}/stop`),
   restartService: (serviceName) => api.post(`/api/services/bus/services/${serviceName}/restart`),
+  listActive: () => api.get('/api/services/active'),
 };
 
 // Accounts API (peer service account provisioning via AccountManager)