test: raise coverage 68.7% -> ~80.4%; add ~250 tests for new egress/DDNS/network paths

Coverage was below acceptable levels and several newly-added code paths
(sshuttle egress, proxy egress, DDNS provider stubs, DNS overview route,
peer-registry provisioning) had zero test coverage.

~250 new unit tests are added across 16 new test files. Existing test files
are updated to match refactored interfaces (DHCP removed, constants
introduced, network_manager restructured). .coveragerc is added to pin the
source mapping and the 70% floor so regressions are caught at commit time.

tests/test_enhanced_api.py was previously living in api/ (wrong location)
and is moved to tests/ where it belongs.

Integration test files are updated to remove references to DHCP endpoints
and add coverage for the new DNS overview and DDNS sync endpoints.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_is_local_request_per_endpoint.py

@@ -33,7 +33,6 @@ Tested local-only endpoints (representative sample):
 Tested public endpoints (no is_local_request guard):
   GET /api/calendar/status
   GET /api/dns/records
-  GET /api/dhcp/leases
   GET /api/cells
 """
 
@@ -216,12 +215,6 @@ class TestPublicEndpointsNotBlockedForNonLocal(unittest.TestCase):
         r = _get_non_local(self.client, '/api/dns/records')
         self.assertNotEqual(r.status_code, 403)
 
-    @patch('app.network_manager')
-    def test_dhcp_leases_not_403_for_non_local(self, mock_nm):
-        mock_nm.get_dhcp_leases.return_value = []
-        r = _get_non_local(self.client, '/api/dhcp/leases')
-        self.assertNotEqual(r.status_code, 403)
-
     @patch('app.cell_link_manager')
     def test_cells_list_not_403_for_non_local(self, mock_clm):
         mock_clm.list_connections.return_value = []