fix: port check, add missing service domains to Caddy and DNS zone

wg show outputs "listening port" not "listen port" — substring mismatch
caused port status to always show Blocked. Add webdav.cell, webmail.cell,
api.cell to Caddyfile and cell.zone so VPN peers can reach all services.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/wireguard_manager.py

@@ -316,7 +316,7 @@ class WireGuardManager(BaseServiceManager):
                 ['docker', 'exec', 'cell-wireguard', 'wg', 'show', 'wg0'],
                 capture_output=True, text=True, timeout=5,
             )
-            if result.returncode == 0 and 'listen port' in result.stdout.lower():
+            if result.returncode == 0 and 'listening port' in result.stdout.lower():
                 return True
         except Exception:
             pass