harden containers: drop WG privileged, slim images, digest pins; fix WG path + empty chrony.conf

Security — WireGuard:
- Replace linuxserver/wireguard (privileged + SYS_MODULE + /lib/modules) with a
  bespoke alpine image (wireguard/Dockerfile + entrypoint.sh): CAP_NET_ADMIN only,
  119 MB → 14.7 MB. Modern kernels (≥5.6) have WireGuard built in; no module
  loading required. Kernel-fallback comment left in compose for rare old kernels.

Security — supply-chain digest pins:
- CoreDNS image pinned by SHA-256 digest in docker-compose.yml.
- api/Dockerfile: python:3.11-slim and docker:27-cli pinned by digest.
- webui/Dockerfile: node:20-alpine and nginxinc/nginx-unprivileged:alpine pinned.
- ntp/Dockerfile: alpine:3.20 pinned by digest.
- wireguard/Dockerfile: alpine:3.20 pinned by digest.

Security — webui non-root:
- Switch from nginx:alpine (root, port 80) to nginxinc/nginx-unprivileged:alpine
  (port 8080, runs as nginx uid 101). Compose port mapping and all Caddy upstream
  references updated: cell-webui:80 → cell-webui:8080 everywhere.

API layer reduction (561 MB → 245 MB):
- Multi-stage api/Dockerfile: docker CLI copied from docker:27-cli stage instead
  of being installed via apt from Docker's external repo (removes GPG key fetch,
  lsb-release, gnupg, two apt-get update rounds). --no-install-recommends on
  remaining apt install. mkdir folded into the same RUN layer.

Bug fix — WireGuard config path mismatch:
- setup_cell.py wrote wg0.conf to config/wireguard/wg0.conf but wireguard_manager
  and the new entrypoint expect config/wireguard/wg_confs/wg0.conf (the standard
  wg-quick sub-directory). Fixed by creating the wg_confs/ sub-dir and writing
  there; REQUIRED_DIRS updated to pre-create it.

Bug fix — empty chrony.conf:
- config/ntp/chrony.conf was 0 bytes (pre-existing gap); added a real config
  (pool.ntp.org + Cloudflare, allow 172.20/10.0, local stratum 10, driftfile,
  makestep, rtcsync). NTP compose service now builds from ./ntp instead of
  pulling alpine:latest and running apk at every container start.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -28,7 +28,7 @@ services:
 
   # DNS Server - CoreDNS for .cell TLD resolution
   dns:
-    image: coredns/coredns:latest
+    image: coredns/coredns:1.11.3@sha256:9caabbf6238b189a65d0d6e6ac138de60d6a1c419e5a341fbbb7c78382559c6e
     container_name: cell-dns
     profiles: ["core", "full"]
     command: ["-conf", "/etc/coredns/Corefile"]
@@ -53,7 +53,7 @@ services:
 
   # NTP Server - chrony for time synchronization
   ntp:
-    image: alpine:latest
+    build: ./ntp
     container_name: cell-ntp
     profiles: ["core", "full"]
     ports:
@@ -69,7 +69,6 @@ services:
         ipv4_address: ${NTP_IP:-172.20.0.5}
     cap_add:
       - SYS_TIME
-    command: ["/bin/sh", "-c", "apk add --no-cache chrony && rm -f /var/run/chrony/chronyd.pid && exec chronyd -d -f /etc/chrony/chrony.conf -n"]
     logging:
       driver: json-file
       options:
@@ -78,18 +77,13 @@ services:
 
   # WireGuard VPN
   wireguard:
-    image: linuxserver/wireguard:latest
+    build: ./wireguard
     container_name: cell-wireguard
     profiles: ["core", "full"]
-    environment:
-      - SERVERMODE=true
-      - PUID=${PUID:-1000}
-      - PGID=${PGID:-1000}
     ports:
       - "${WG_PORT:-51820}:${WG_PORT:-51820}/udp"
     volumes:
       - ./config/wireguard:/config
-      - /lib/modules:/lib/modules
     restart: unless-stopped
     mem_limit: 256m
     cpus: 0.5
@@ -99,8 +93,9 @@ services:
         ipv4_address: ${WG_IP:-172.20.0.9}
     cap_add:
       - NET_ADMIN
-      - SYS_MODULE
-    privileged: true
+    # FALLBACK for kernels lacking builtin WireGuard: re-add `privileged: true`,
+    # `- SYS_MODULE` under cap_add, and the `- /lib/modules:/lib/modules` volume.
+    # Default assumes a modern kernel (>= 5.6) with WireGuard compiled in.
     sysctls:
       - net.ipv4.conf.all.src_valid_mark=1
       - net.ipv4.ip_forward=1
@@ -157,7 +152,7 @@ services:
     container_name: cell-webui
     profiles: ["core", "full"]
     ports:
-      - "${WEBUI_PORT:-8081}:80"
+      - "${WEBUI_PORT:-8081}:8080"
     restart: unless-stopped
     mem_limit: 256m
     cpus: 0.5