test: raise coverage 68.7% -> ~80.4%; add ~250 tests for new egress/DDNS/network paths

Coverage was below acceptable levels and several newly-added code paths
(sshuttle egress, proxy egress, DDNS provider stubs, DNS overview route,
peer-registry provisioning) had zero test coverage.

~250 new unit tests are added across 16 new test files. Existing test files
are updated to match refactored interfaces (DHCP removed, constants
introduced, network_manager restructured). .coveragerc is added to pin the
source mapping and the 70% floor so regressions are caught at commit time.

tests/test_enhanced_api.py was previously living in api/ (wrong location)
and is moved to tests/ where it belongs.

Integration test files are updated to remove references to DHCP endpoints
and add coverage for the new DNS overview and DDNS sync endpoints.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_peer_provisioning.py

@@ -171,18 +171,85 @@ def test_create_peer_returns_201(admin_client):
 
 
 def test_create_peer_provisions_all_services(
-        admin_client, auth_mgr,
-        mock_email_mgr, mock_calendar_mgr, mock_file_mgr):
-    """All four service create methods must be called exactly once."""
-    _post_peer(admin_client)
-    # auth provisioning — check user was created in the real auth_mgr
-    # (we use the real auth_mgr so we can inspect the result directly)
-    alice = auth_mgr.get_user('alice')
-    assert alice is not None, 'auth_manager.create_user was not called for alice'
+        auth_mgr, mock_email_mgr, mock_calendar_mgr,
+        mock_file_mgr, mock_wg_mgr, mock_peer_registry):
+    """With email/calendar/files all installed, all four service create methods
+    must be called exactly once."""
+    patches = _make_admin_client_with_installed(
+        auth_mgr, mock_email_mgr, mock_calendar_mgr,
+        mock_file_mgr, mock_wg_mgr, mock_peer_registry,
+        installed_services={'email': {}, 'calendar': {}, 'files': {}},
+    )
+    started = [p.start() for p in patches]
+    try:
+        with app.test_client() as client:
+            _login(client)
+            r = _post_peer(client)
+            assert r.status_code == 201, f'{r.status_code}: {r.data}'
 
-    mock_email_mgr.create_email_user.assert_called_once()
-    mock_calendar_mgr.create_calendar_user.assert_called_once()
-    mock_file_mgr.create_user.assert_called_once()
+        # auth provisioning — check user was created in the real auth_mgr
+        # (we use the real auth_mgr so we can inspect the result directly)
+        alice = auth_mgr.get_user('alice')
+        assert alice is not None, 'auth_manager.create_user was not called for alice'
+
+        mock_email_mgr.create_email_user.assert_called_once()
+        mock_calendar_mgr.create_calendar_user.assert_called_once()
+        mock_file_mgr.create_user.assert_called_once()
+    finally:
+        for p in patches:
+            p.stop()
+
+
+def test_create_peer_skips_builtin_provisioning_when_not_installed(
+        auth_mgr, mock_email_mgr, mock_calendar_mgr,
+        mock_file_mgr, mock_wg_mgr, mock_peer_registry):
+    """With no store services installed, email/calendar/files account creation
+    must NOT be attempted — those services do not exist on this cell."""
+    patches = _make_admin_client_with_installed(
+        auth_mgr, mock_email_mgr, mock_calendar_mgr,
+        mock_file_mgr, mock_wg_mgr, mock_peer_registry,
+        installed_services={},
+    )
+    started = [p.start() for p in patches]
+    try:
+        with app.test_client() as client:
+            _login(client)
+            r = _post_peer(client)
+            assert r.status_code == 201, f'{r.status_code}: {r.data}'
+
+        # Auth account is always created
+        assert auth_mgr.get_user('alice') is not None
+
+        mock_email_mgr.create_email_user.assert_not_called()
+        mock_calendar_mgr.create_calendar_user.assert_not_called()
+        mock_file_mgr.create_user.assert_not_called()
+    finally:
+        for p in patches:
+            p.stop()
+
+
+def test_create_peer_provisions_only_installed_subset(
+        auth_mgr, mock_email_mgr, mock_calendar_mgr,
+        mock_file_mgr, mock_wg_mgr, mock_peer_registry):
+    """With only calendar installed, only the calendar account is provisioned."""
+    patches = _make_admin_client_with_installed(
+        auth_mgr, mock_email_mgr, mock_calendar_mgr,
+        mock_file_mgr, mock_wg_mgr, mock_peer_registry,
+        installed_services={'calendar': {}},
+    )
+    started = [p.start() for p in patches]
+    try:
+        with app.test_client() as client:
+            _login(client)
+            r = _post_peer(client)
+            assert r.status_code == 201, f'{r.status_code}: {r.data}'
+
+        mock_calendar_mgr.create_calendar_user.assert_called_once()
+        mock_email_mgr.create_email_user.assert_not_called()
+        mock_file_mgr.create_user.assert_not_called()
+    finally:
+        for p in patches:
+            p.stop()
 
 
 def test_create_peer_response_has_ip(admin_client):
@@ -231,8 +298,13 @@ def test_create_peer_email_failure_is_nonfatal(
     app.config['TESTING'] = True
     app.config['SECRET_KEY'] = 'test-secret'
 
+    # email must be installed for its provisioning step to run at all
+    mock_cfg = MagicMock()
+    mock_cfg.get_installed_services.return_value = {'email': {}}
+
     patches = [
         patch('app.auth_manager', auth_mgr),
+        patch('app.config_manager', mock_cfg),
         patch('app.email_manager', mock_email_mgr),
         patch('app.calendar_manager', mock_calendar_mgr),
         patch('app.file_manager', mock_file_mgr),