fix: DNS split-horizon in DDNS mode, service access filter, health check, verbosity persistence

- DNS (critical): add _configured_dns_params() that returns (primary_domain,
  split_horizon_zones) from config_manager so all apply_all_dns_rules() callers
  pass the correct primary zone (e.g. 'pic.ngo') and split-horizon list
  (e.g. ['pic1.pic.ngo']) instead of the FQDN as the primary — fixes
  DNS_PROBE_FINISHED_BAD_CONFIG for all external domains when on VPN

- firewall_manager: add split_horizon_zones param to apply_all_dns_rules()
  and forward it to generate_corefile()

- Peers: filter service_access list to installed services only; peers.py
  derives valid services from config_manager.get_installed_services() with
  the email→mail ID mapping; Peers.jsx fetches from /api/store/installed
  and filters the checkboxes and defaults accordingly

- Health check: fix file_manager→'files' ID mapping so files service health
  is checked when installed (was silently skipped due to 'file' vs 'files')

- Verbosity persistence: move log_levels.json from non-mounted
  /app/api/config/ to CONFIG_DIR (/app/config/) which maps to config/api/
  on the host; both load (managers.py) and save (routes/services.py) updated

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routes/wireguard.py

@@ -265,7 +265,7 @@ def refresh_external_ip():
 def apply_wireguard_enforcement():
     try:
         from app import (peer_registry, wireguard_manager, firewall_manager,
-                         cell_link_manager, _configured_domain, COREFILE_PATH)
+                         cell_link_manager, _configured_dns_params, COREFILE_PATH)
         peers = peer_registry.list_peers()
         try:
             _wg_addr = wireguard_manager._get_configured_address()
@@ -275,8 +275,10 @@ def apply_wireguard_enforcement():
         _cell_links = cell_link_manager.list_connections()
         _cell_subnets = [l['vpn_subnet'] for l in _cell_links if l.get('vpn_subnet')]
         firewall_manager.apply_all_peer_rules(peers, wg_subnet=_wg_subnet, cell_subnets=_cell_subnets)
-        firewall_manager.apply_all_dns_rules(peers, COREFILE_PATH, _configured_domain(),
-                                             cell_links=_cell_links)
+        _dns_primary, _dns_szones = _configured_dns_params()
+        firewall_manager.apply_all_dns_rules(peers, COREFILE_PATH, _dns_primary,
+                                             cell_links=_cell_links,
+                                             split_horizon_zones=_dns_szones)
         return jsonify({'ok': True, 'peers': len(peers)})
     except Exception as e:
         return jsonify({'error': str(e)}), 500