feat: Phase 5 — remove legacy service blocks, one-shot container cleanup

Email, calendar, files, webmail (rainloop), and the file manager (filegator)
are removed from the main docker-compose stack. They install as independent
per-service compose projects via ServiceComposer.

On startup, _cleanup_legacy_builtin_containers() stops and removes any of the
5 legacy containers still running from the old main stack (guarded by a
one-shot sentinel in _meta.legacy_builtins_cleaned so it never runs twice).
Per-service installs (com.docker.compose.project != 'pic') are left untouched.

Changes:
- docker-compose.yml: remove mail, radicale, webdav, rainloop, filegator blocks;
  fix dhcp + ntp to profiles: ["core","full"] so they start with --profile core
- Makefile: replace all --profile full with --profile core (6 occurrences);
  remove mailserver.env conditional from update: target
- api/legacy_cleanup.py: new module with cleanup_legacy_builtin_containers()
- api/app.py: import and call cleanup at startup before reapply_on_startup()
- tests/test_legacy_cleanup.py: 7 tests covering sentinel, absent containers,
  per-service project skip, main-stack removal, exception safety

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -54,6 +54,7 @@ from cell_manager import CellManager
 from wireguard_manager import _resolve_peer_dns
 from port_registry import PORT_FIELDS, detect_conflicts
 import auth_routes
+from legacy_cleanup import cleanup_legacy_builtin_containers
 
 # Context variable for request info
 request_context = contextvars.ContextVar('request_context', default={})
@@ -374,6 +375,11 @@ def _apply_startup_enforcement():
         sync_summary = cell_link_manager.replay_pending_pushes()
         if sync_summary.get('attempted'):
             logger.info(f"Startup permission sync: {sync_summary}")
+        # Remove legacy builtin containers from old main stack (one-shot, idempotent)
+        try:
+            cleanup_legacy_builtin_containers(config_manager)
+        except Exception as _cle:
+            logger.warning(f'legacy cleanup failed (non-fatal): {_cle}')
         # Service store: re-apply firewall/caddy rules for installed services
         try:
             service_store_manager.reapply_on_startup()