refactor: Network Services rebuilt, DHCP decommissioned, infra cleanup

Network Services page is rebuilt around real API data: GET /api/dns/overview
returns provider-aware records; per-service Cloudflare sync is exposed via
POST /api/ddns/sync; effective domain is displayed so operators can verify
what external name resolves to the cell; NTP status reflects the actual
systemd-timesyncd state rather than a hardcoded boolean.

DHCP is fully decommissioned: the cell-dhcp container is removed from
docker-compose.yml, DHCP methods are stripped from network_manager, the
setup_cell script no longer seeds DHCP config, and the Settings DHCP field
is gone. DHCP was never a PIC responsibility and the container was consuming
resources for no benefit.

Dead code removed: api/config.py (superseded by config_manager), the
standalone Email/Calendar/Files pages (these are now optional store services
and do not need dedicated pages). api/constants.py is introduced to hold
RESERVED_SUBDOMAINS in one place rather than scattered literals.

Docker resource limits (mem_limit, cpus, pids_limit) are added to all
compose services so a runaway process cannot starve the host.

Makefile gains a warning before the backup target so operators are not
surprised by the archive path. Settings same/accept state fix ensures
the Cell Identity section correctly shows the accept/discard banner and
does not flash a false-positive change indicator on first load.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/setup_cell.py

@@ -17,13 +17,11 @@ import sys
 REQUIRED_DIRS = [
     'config/caddy/certs',
     'config/dns',
-    'config/dhcp',
     'config/ntp',
     'config/wireguard',
     'config/api',
     'data/caddy',
     'data/dns',
-    'data/dhcp',
     'data/api',
     'data/vault/certs',
     'data/vault/keys',
@@ -37,7 +35,6 @@ REQUIRED_DIRS = [
 
 REQUIRED_FILES = [
     'config/dns/Corefile',
-    'config/dhcp/dnsmasq.conf',
     'config/ntp/chrony.conf',
 ]