refactor: Network Services rebuilt, DHCP decommissioned, infra cleanup

Network Services page is rebuilt around real API data: GET /api/dns/overview
returns provider-aware records; per-service Cloudflare sync is exposed via
POST /api/ddns/sync; effective domain is displayed so operators can verify
what external name resolves to the cell; NTP status reflects the actual
systemd-timesyncd state rather than a hardcoded boolean.

DHCP is fully decommissioned: the cell-dhcp container is removed from
docker-compose.yml, DHCP methods are stripped from network_manager, the
setup_cell script no longer seeds DHCP config, and the Settings DHCP field
is gone. DHCP was never a PIC responsibility and the container was consuming
resources for no benefit.

Dead code removed: api/config.py (superseded by config_manager), the
standalone Email/Calendar/Files pages (these are now optional store services
and do not need dedicated pages). api/constants.py is introduced to hold
RESERVED_SUBDOMAINS in one place rather than scattered literals.

Docker resource limits (mem_limit, cpus, pids_limit) are added to all
compose services so a runaway process cannot starve the host.

Makefile gains a warning before the backup target so operators are not
surprised by the archive path. Settings same/accept state fix ensures
the Cell Identity section correctly shows the accept/discard banner and
does not flash a false-positive change indicator on first load.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -14,6 +14,9 @@ services:
       - ./data/caddy:/data
       - ./config/caddy/certs:/config/caddy/certs
     restart: unless-stopped
+    mem_limit: 256m
+    cpus: 0.5
+    pids_limit: 256
     cap_add:
       - NET_ADMIN
     networks:
@@ -38,6 +41,9 @@ services:
       - ./config/dns/Corefile:/etc/coredns/Corefile
       - ./data/dns:/data
     restart: unless-stopped
+    mem_limit: 128m
+    cpus: 0.25
+    pids_limit: 256
     networks:
       cell-network:
         ipv4_address: ${DNS_IP:-172.20.0.3}
@@ -47,29 +53,6 @@ services:
         max-size: "10m"
         max-file: "5"
 
-  # DHCP Server - dnsmasq for IP leasing
-  dhcp:
-    image: alpine:latest
-    container_name: cell-dhcp
-    profiles: ["core", "full"]
-    ports:
-      - "${DHCP_PORT:-67}:67/udp"
-    volumes:
-      - ./config/dhcp/dnsmasq.conf:/etc/dnsmasq.conf
-      - ./data/dhcp:/var/lib/misc
-    restart: unless-stopped
-    networks:
-      cell-network:
-        ipv4_address: ${DHCP_IP:-172.20.0.4}
-    command: ["/bin/sh", "-c", "apk add --no-cache dnsmasq && dnsmasq -d -C /etc/dnsmasq.conf"]
-    cap_add:
-      - NET_ADMIN
-    logging:
-      driver: json-file
-      options:
-        max-size: "10m"
-        max-file: "5"
-
   # NTP Server - chrony for time synchronization
   ntp:
     image: alpine:latest
@@ -80,6 +63,9 @@ services:
     volumes:
       - ./config/ntp/chrony.conf:/etc/chrony/chrony.conf
     restart: unless-stopped
+    mem_limit: 128m
+    cpus: 0.25
+    pids_limit: 256
     networks:
       cell-network:
         ipv4_address: ${NTP_IP:-172.20.0.5}
@@ -107,6 +93,9 @@ services:
       - ./config/wireguard:/config
       - /lib/modules:/lib/modules
     restart: unless-stopped
+    mem_limit: 256m
+    cpus: 0.5
+    pids_limit: 256
     networks:
       cell-network:
         ipv4_address: ${WG_IP:-172.20.0.9}
@@ -149,6 +138,9 @@ services:
       - ./scripts:/app/scripts:ro
     pid: host
     restart: unless-stopped
+    mem_limit: 512m
+    cpus: 1.0
+    pids_limit: 256
     networks:
       cell-network:
         ipv4_address: ${API_IP:-172.20.0.10}
@@ -169,6 +161,9 @@ services:
     ports:
       - "${WEBUI_PORT:-8081}:80"
     restart: unless-stopped
+    mem_limit: 256m
+    cpus: 0.5
+    pids_limit: 256
     networks:
       cell-network:
         ipv4_address: ${WEBUI_IP:-172.20.0.11}