feat: external IP detection, port status, fix peer config generation

- WireGuardManager: get_external_ip() (cached 1h), check_port_open(),
  get_server_config() returning public_key + detected endpoint
- API: /api/wireguard/server-config returns real external IP;
  /api/wireguard/refresh-ip forces re-detection;
  /api/wireguard/peers/config now looks up peer IP + private key from
  registry and uses real server endpoint automatically
- Fix doubled port in Endpoint (178.x:51820:51820 → 178.x:51820)
- Fix Address=/32 when peer_ip already has mask
- WebUI nginx: proxy /api/ and /health to cell-api (fixes localhost:3000
  hardcode — UI now works from any machine)
- api.js: baseURL='' so all calls go through nginx proxy
- WireGuard page: show Server Endpoint card with external IP, endpoint,
  public key, and Refresh IP button

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -876,11 +876,28 @@ def get_network_status():
 def get_peer_config():
     try:
         data = request.get_json(silent=True) or {}
+        peer_name = data.get('name', data.get('peer', ''))
+
+        # Look up peer details from registry if not supplied
+        peer_ip = data.get('ip', '')
+        peer_private_key = data.get('private_key', '')
+        if peer_name and (not peer_ip or not peer_private_key):
+            registered = peer_registry.get_peer(peer_name)
+            if registered:
+                peer_ip = peer_ip or registered.get('ip', '')
+                peer_private_key = peer_private_key or registered.get('private_key', '')
+
+        # Use real external endpoint if not supplied
+        server_endpoint = data.get('server_endpoint', '')
+        if not server_endpoint:
+            srv = wireguard_manager.get_server_config()
+            server_endpoint = srv.get('endpoint') or '<SERVER_IP>'
+
         result = wireguard_manager.get_peer_config(
-            peer_name=data.get('name', data.get('peer', '')),
-            peer_ip=data.get('ip', ''),
-            peer_private_key=data.get('private_key', ''),
-            server_endpoint=data.get('server_endpoint', '<SERVER_IP>')
+            peer_name=peer_name,
+            peer_ip=peer_ip,
+            peer_private_key=peer_private_key,
+            server_endpoint=server_endpoint,
         )
         return jsonify({"config": result})
     except Exception as e:
@@ -890,13 +907,27 @@ def get_peer_config():
 @app.route('/api/wireguard/server-config', methods=['GET'])
 def get_server_config():
     try:
-        # Get server configuration from WireGuard manager
         config = wireguard_manager.get_server_config()
         return jsonify(config)
     except Exception as e:
         logger.error(f"Error getting server config: {e}")
         return jsonify({"error": str(e)}), 500
 
+@app.route('/api/wireguard/refresh-ip', methods=['POST'])
+def refresh_external_ip():
+    try:
+        ip = wireguard_manager.get_external_ip(force_refresh=True)
+        port_open = wireguard_manager.check_port_open()
+        return jsonify({
+            'external_ip': ip,
+            'port': wireguard_manager.DEFAULT_PORT if hasattr(wireguard_manager, 'DEFAULT_PORT') else 51820,
+            'port_open': port_open,
+            'endpoint': f'{ip}:{51820}' if ip else None,
+        })
+    except Exception as e:
+        logger.error(f"Error refreshing external IP: {e}")
+        return jsonify({"error": str(e)}), 500
+
 # Peer Registry API
 @app.route('/api/peers', methods=['GET'])
 def get_peers():