fix: install chrony for host NTP and enable pic.service on cold install

Root-cause fix for ACME failures caused by clock drift breaking TOTP
during DDNS registration: install and start chrony (all supported package
managers) before the setup wizard runs, so the host clock is accurate from
day one.

Also enables and starts the pic systemd unit at the end of a cold install —
previously the unit file was written but never activated, so the stack would
not survive a reboot without a manual `systemctl enable --now pic`.

Makefile uninstall hardened: `disable --now` instead of bare `disable` so the
running unit is stopped before the unit file is removed; daemon-reload called
afterwards to flush the stale unit; and all lingering cell-* containers
(tor/sshuttle/redsocks/store services) are now force-removed so subsequent
reinstalls start from a clean Docker state.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Makefile

@@ -182,6 +182,7 @@ uninstall:
 	    echo "Stopping containers and removing images..."; \
 	    for f in data/api/services/*/docker-compose.yml; do [ -f "$$f" ] && PUID=$$(id -u) PGID=$$(id -g) docker compose -f "$$f" down 2>/dev/null || true; done; \
 	    PUID=$$(id -u) PGID=$$(id -g) $(DCF) --profile core down --rmi all 2>/dev/null || true; \
+	    docker ps -aq --filter "name=cell-" | xargs -r docker rm -f 2>/dev/null || true; \
 	    docker network rm cell-network 2>/dev/null || true; \
 	    echo "Deleting config/ and data/..."; \
 	    sudo rm -rf config/ data/; \
@@ -191,14 +192,18 @@ uninstall:
 	    echo "Stopping and removing containers (keeping images and data)..."; \
 	    for f in data/api/services/*/docker-compose.yml; do [ -f "$$f" ] && PUID=$$(id -u) PGID=$$(id -g) docker compose -f "$$f" down 2>/dev/null || true; done; \
 	    PUID=$$(id -u) PGID=$$(id -g) $(DCF) --profile core down 2>/dev/null || true; \
+	    docker ps -aq --filter "name=cell-" | xargs -r docker rm -f 2>/dev/null || true; \
 	    echo "Done. Images, config/ and data/ are untouched. Run 'make start' to bring it back up."; \
 	    ;; \
 	  *) \
 	    echo "Cancelled."; \
 	    ;; \
 	esac
-	@-sudo systemctl disable pic 2>/dev/null || true
-	@-sudo rm -f /etc/systemd/system/pic.service
+	@if command -v systemctl >/dev/null 2>&1; then \
+	  sudo systemctl disable --now pic 2>/dev/null || true; \
+	  sudo rm -f /etc/systemd/system/pic.service; \
+	  sudo systemctl daemon-reload 2>/dev/null || true; \
+	fi
 	@-sudo rm -f /opt/pic/.installed
 	@echo "Note: Data volumes were not deleted. To remove all data, manually delete config/ and data/."