test: raise coverage 68.7% -> ~80.4%; add ~250 tests for new egress/DDNS/network paths

Coverage was below acceptable levels and several newly-added code paths
(sshuttle egress, proxy egress, DDNS provider stubs, DNS overview route,
peer-registry provisioning) had zero test coverage.

~250 new unit tests are added across 16 new test files. Existing test files
are updated to match refactored interfaces (DHCP removed, constants
introduced, network_manager restructured). .coveragerc is added to pin the
source mapping and the 70% floor so regressions are caught at commit time.

tests/test_enhanced_api.py was previously living in api/ (wrong location)
and is moved to tests/ where it belongs.

Integration test files are updated to remove references to DHCP endpoints
and add coverage for the new DNS overview and DDNS sync endpoints.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_connectivity_manager.py

@@ -744,5 +744,124 @@ class TestApplyRoutes(unittest.TestCase):
         self.assertIsInstance(result['rules_applied'], int)
 
 
+# ---------------------------------------------------------------------------
+# _exit_status — status string + store-service bridge
+# ---------------------------------------------------------------------------
+
+class TestExitStatus(unittest.TestCase):
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def _mgr(self, installed=None):
+        config_manager = MagicMock()
+        config_manager.get_installed_services.return_value = installed or {}
+        return _make_manager(tmp_dir=self.tmp, config_manager=config_manager)
+
+    def test_status_not_configured_when_nothing_present(self):
+        mgr = self._mgr()
+        with patch.object(cm_module, 'subprocess') as mock_sp:
+            mock_sp.run.return_value = MagicMock(returncode=1, stdout='', stderr='')
+            info = mgr._exit_status('wireguard_ext')
+        self.assertEqual(info['status'], 'not_configured')
+        self.assertFalse(info['configured'])
+        self.assertFalse(info['iface_up'])
+
+    def test_status_configured_when_legacy_file_present(self):
+        mgr = self._mgr()
+        path = os.path.join(mgr.wireguard_ext_dir, 'wg_ext0.conf')
+        with open(path, 'w') as f:
+            f.write('[Interface]\nPrivateKey = abc\n')
+        with patch.object(cm_module, 'subprocess') as mock_sp:
+            mock_sp.run.return_value = MagicMock(returncode=1, stdout='', stderr='')
+            info = mgr._exit_status('wireguard_ext')
+        self.assertTrue(info['configured'])
+        self.assertEqual(info['status'], 'configured')
+
+    def test_status_active_when_iface_up(self):
+        mgr = self._mgr()
+        path = os.path.join(mgr.wireguard_ext_dir, 'wg_ext0.conf')
+        with open(path, 'w') as f:
+            f.write('[Interface]\nPrivateKey = abc\n')
+        with patch.object(cm_module, 'subprocess') as mock_sp:
+            mock_sp.run.return_value = MagicMock(
+                returncode=0, stdout='4: wg_ext0: <UP,LOWER_UP>', stderr=''
+            )
+            info = mgr._exit_status('wireguard_ext')
+        self.assertTrue(info['iface_up'])
+        self.assertEqual(info['status'], 'active')
+
+    def test_store_installed_wireguard_ext_reports_configured(self):
+        mgr = self._mgr(installed={'wireguard-ext': {'manifest': {'id': 'wireguard-ext'}}})
+        with patch.object(cm_module, 'subprocess') as mock_sp:
+            mock_sp.run.return_value = MagicMock(returncode=1, stdout='', stderr='')
+            info = mgr._exit_status('wireguard_ext')
+        self.assertTrue(info['configured'])
+        self.assertEqual(info['status'], 'configured')
+
+    def test_store_installed_openvpn_client_reports_configured(self):
+        mgr = self._mgr(installed={'openvpn-client': {'manifest': {'id': 'openvpn-client'}}})
+        with patch.object(cm_module, 'subprocess') as mock_sp:
+            mock_sp.run.return_value = MagicMock(returncode=1, stdout='', stderr='')
+            info = mgr._exit_status('openvpn')
+        self.assertTrue(info['configured'])
+        self.assertEqual(info['status'], 'configured')
+
+    def test_unrelated_store_service_does_not_configure_exit(self):
+        mgr = self._mgr(installed={'email': {'manifest': {'id': 'email'}}})
+        with patch.object(cm_module, 'subprocess') as mock_sp:
+            mock_sp.run.return_value = MagicMock(returncode=1, stdout='', stderr='')
+            info = mgr._exit_status('wireguard_ext')
+        self.assertFalse(info['configured'])
+        self.assertEqual(info['status'], 'not_configured')
+
+    def test_running_container_reports_configured(self):
+        mgr = self._mgr()
+
+        def fake_run(cmd, **kwargs):
+            if 'inspect' in cmd:
+                return MagicMock(returncode=0, stdout='true\n', stderr='')
+            return MagicMock(returncode=1, stdout='', stderr='')
+
+        with patch.object(cm_module, 'subprocess') as mock_sp:
+            mock_sp.run.side_effect = fake_run
+            info = mgr._exit_status('wireguard_ext')
+        self.assertTrue(info['configured'])
+        self.assertEqual(info['status'], 'configured')
+
+    def test_stopped_container_does_not_configure_exit(self):
+        mgr = self._mgr()
+
+        def fake_run(cmd, **kwargs):
+            if 'inspect' in cmd:
+                return MagicMock(returncode=0, stdout='false\n', stderr='')
+            return MagicMock(returncode=1, stdout='', stderr='')
+
+        with patch.object(cm_module, 'subprocess') as mock_sp:
+            mock_sp.run.side_effect = fake_run
+            info = mgr._exit_status('wireguard_ext')
+        self.assertFalse(info['configured'])
+
+    def test_list_exits_entries_have_status_string(self):
+        mgr = self._mgr()
+        with patch.object(cm_module, 'subprocess') as mock_sp:
+            mock_sp.run.return_value = _mock_subprocess_ok()
+            exits = mgr.list_exits()
+        for item in exits:
+            self.assertIn('status', item)
+            self.assertIn(item['status'], ('active', 'configured', 'not_configured'))
+
+    def test_tor_defaults_to_configured(self):
+        mgr = self._mgr()
+        with patch.object(cm_module, 'subprocess') as mock_sp:
+            mock_sp.run.return_value = MagicMock(returncode=1, stdout='', stderr='')
+            info = mgr._exit_status('tor')
+        self.assertTrue(info['configured'])
+        self.assertEqual(info['status'], 'configured')
+
+
 if __name__ == '__main__':
     unittest.main()