fix: port check, add missing service domains to Caddy and DNS zone

wg show outputs "listening port" not "listen port" — substring mismatch
caused port status to always show Blocked. Add webdav.cell, webmail.cell,
api.cell to Caddyfile and cell.zone so VPN peers can reach all services.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/wireguard_manager.py

@@ -316,7 +316,7 @@ class WireGuardManager(BaseServiceManager):
                 ['docker', 'exec', 'cell-wireguard', 'wg', 'show', 'wg0'],
                 capture_output=True, text=True, timeout=5,
             )
-            if result.returncode == 0 and 'listen port' in result.stdout.lower():
+            if result.returncode == 0 and 'listening port' in result.stdout.lower():
                 return True
         except Exception:
             pass

config/caddy/Caddyfile

@@ -30,10 +30,18 @@ http://files.cell {
     reverse_proxy cell-filegator:8080
 }
 
-http://mail.cell {
+http://mail.cell, http://webmail.cell {
     reverse_proxy cell-rainloop:8888
 }
 
+http://webdav.cell {
+    reverse_proxy cell-webdav:80
+}
+
+http://api.cell {
+    reverse_proxy cell-api:3000
+}
+
 # Catch-all for direct IP and localhost access
 :80 {
     handle /api/* {