feat: add integration test suite (66 tests covering live API + services + UI)

Tests cover health, config, all 12 containers, WireGuard, DNS/DHCP/NTP,
services status, peer CRUD with iptables rule verification, service_access
enforcement (full/restricted/no-access), and WebUI smoke tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Makefile

@@ -8,6 +8,7 @@
         backup restore \
         test test-all test-unit test-coverage test-api test-cli \
         test-phase1 test-phase2 test-phase3 test-phase4 test-all-phases \
+        test-integration test-integration-readonly \
         show-routes add-peer list-peers
 
 # Detect docker compose command (v2 plugin preferred, fallback to v1 standalone)
@@ -54,7 +55,9 @@ help:
 	@echo ""
 	@echo "Tests:"
 	@echo "  test           - Run all tests"
-	@echo "  test-coverage  - Run tests with HTML coverage report"
+	@echo "  test-coverage          - Run tests with HTML coverage report"
+	@echo "  test-integration       - Full integration tests (needs running stack)"
+	@echo "  test-integration-readonly - Read-only integration tests (safe to run anytime)"
 	@echo ""
 	@echo "Peers:"
 	@echo "  list-peers     - List configured WireGuard peers"
@@ -227,6 +230,14 @@ test-unit:
 test-coverage:
 	pytest tests/ api/tests/ --cov=api --cov-report=html --cov-report=term-missing --cov-fail-under=70 -v
 
+test-integration:
+	@echo "Running full integration tests (requires running PIC stack)..."
+	PIC_HOST=$${PIC_HOST:-localhost} pytest tests/integration/ -v
+
+test-integration-readonly:
+	@echo "Running read-only integration tests (no peer creation)..."
+	PIC_HOST=$${PIC_HOST:-localhost} pytest tests/integration/test_live_api.py tests/integration/test_webui.py -v
+
 test-api:
 	cd api && python3 -m pytest tests/test_api_endpoints.py -v