Test: skip peer-sync push test when WG tunnel between cells is not active

The test_remote_permissions_pushed_to_cell2 test verifies that permission
changes on cell1 are pushed to cell2 via the WireGuard tunnel. When both
cells use a public endpoint (DDNS VPS) instead of LAN IPs, no tunnel is
established and the push silently fails. The test now probes cell2's API
at its WG DNS IP before asserting the push succeeded — skips gracefully
if the tunnel is down rather than failing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/e2e/api/test_cell_to_cell.py

@@ -433,10 +433,24 @@ class TestLiveCellConnection:
 
         After cell1 sets outbound.calendar=True (= cell2 gets inbound.calendar=True
         from cell1), we verify that cell2's stored remote view is updated.
-        This test requires the cells to be able to reach each other's API on port 3000.
+        Requires cells to reach each other's API via the WireGuard tunnel (DNS IP on
+        port 3000).  Skipped when the WG tunnel between cells is not active.
         """
         cell1_name, cell2_name = self._connect_cells(admin_client, cell2_client)
 
+        # Verify the WG tunnel is up: cell1 must be able to reach cell2's API
+        # at cell2's WireGuard DNS IP before we assert that the push succeeded.
+        invite2 = _get_invite(cell2_client)
+        cell2_dns_ip = invite2['dns_ip']
+        import requests as _req
+        try:
+            _req.get(f'http://{cell2_dns_ip}:3000/health', timeout=2)
+        except Exception:
+            pytest.skip(
+                f"Cell2 not reachable at http://{cell2_dns_ip}:3000 via WG tunnel — "
+                "peer-sync push requires an active tunnel between the two cells"
+            )
+
         # cell1 enables outbound calendar to cell2
         inbound = {'calendar': False, 'files': False, 'mail': False, 'webdav': False}
         outbound = {'calendar': True, 'files': False, 'mail': False, 'webdav': False}