fix: restore/import no longer zeros unconfigured services; domain change updates DNS

config_manager restore_config and import_config previously injected zero-filled
entries (port=0, domain='') for every service schema regardless of whether that
service was in the backup/import data. Removed this logic — only restore what's
actually in the backup.

network_manager.apply_domain now:
- updates dnsmasq.conf domain= line (reload cell-dhcp)
- rewrites Corefile zone blocks to the new domain name
- renames and rewrites the primary zone file $ORIGIN + SOA records
- reloads CoreDNS

Tests added first (TDD):
- test_restore_does_not_zero_unconfigured_services
- test_restore_does_not_zero_import
- test_apply_domain_updates_corefile (zone file + Corefile)
- test_apply_domain_updates_dnsmasq
- test_apply_config_writes_dhcp_range / ntp_servers
- test_apply_config_updates_mailserver_env / no_domain_no_restart

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/config_manager.py

@@ -260,27 +260,8 @@ class ConfigManager:
             secrets_backup = backup_path / 'secrets.yaml'
             if secrets_backup.exists():
                 shutil.copy2(secrets_backup, self.secrets_file)
-            # Reload configurations
+            # Reload configurations — restore only what was in the backup
             self.configs = self._load_all_configs()
-            # Ensure all configs have required fields
-            for service, schema in self.service_schemas.items():
-                config = self.configs.get(service, {})
-                for field in schema['required']:
-                    if field not in config:
-                        # Set a default value based on type
-                        t = schema['types'][field]
-                        if t is int:
-                            config[field] = 0
-                        elif t is str:
-                            config[field] = ''
-                        elif t is list:
-                            config[field] = []
-                        elif t is bool:
-                            config[field] = False
-                self.configs[service] = config
-            
-            # Write back to file
-            self._save_all_configs()
             logger.info(f"Restored configuration from backup: {backup_id}")
             return True
         except Exception as e:
@@ -351,26 +332,10 @@ class ConfigManager:
                 configs = yaml.safe_load(config_data)
             else:
                 raise ValueError(f"Unsupported format: {format}")
-            # Validate and update each service config
+            # Import only services present in the data — don't fabricate missing ones
             for service, config in configs.items():
                 if service in self.service_schemas:
                     self.update_service_config(service, config)
-            # Ensure all configs have required fields
-            for service, schema in self.service_schemas.items():
-                config = self.get_service_config(service)
-                for field in schema['required']:
-                    if field not in config:
-                        t = schema['types'][field]
-                        if t is int:
-                            config[field] = 0
-                        elif t is str:
-                            config[field] = ''
-                        elif t is list:
-                            config[field] = []
-                        elif t is bool:
-                            config[field] = False
-                # Write back to file
-                self._save_all_configs()
             logger.info("Imported configurations successfully")
             return True
         except Exception as e: