fix: split-horizon DNS zone uses WireGuard IP, not Docker bridge IP

VPN peers can reach Caddy via the host's WireGuard interface (10.0.0.1),
not via the Docker bridge IP (172.20.0.2) which is unreachable outside
the container network. _bootstrap_dns now calls _get_wg_server_ip()
instead of ip_utils.get_service_ips() so the internal zone returns a
routable address for service subdomains.

Also log config save failures instead of silently swallowing them —
the silent PermissionError/OSError was masking write failures and
making it impossible to diagnose why installed services disappeared
after container restarts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/config_manager.py

@@ -163,8 +163,8 @@ class ConfigManager:
                 f.flush()
                 os.fsync(f.fileno())
             os.replace(tmp, self.config_file)
-        except (PermissionError, OSError):
-            pass
+        except (PermissionError, OSError) as e:
+            logger.error('_save_all_configs: write failed — config NOT persisted to disk: %s', e)
 
     def get_service_config(self, service: str) -> Dict[str, Any]:
         """Get configuration for a specific service"""