harden containers: drop WG privileged, slim images, digest pins; fix WG path + empty chrony.conf

Security — WireGuard:
- Replace linuxserver/wireguard (privileged + SYS_MODULE + /lib/modules) with a
  bespoke alpine image (wireguard/Dockerfile + entrypoint.sh): CAP_NET_ADMIN only,
  119 MB → 14.7 MB. Modern kernels (≥5.6) have WireGuard built in; no module
  loading required. Kernel-fallback comment left in compose for rare old kernels.

Security — supply-chain digest pins:
- CoreDNS image pinned by SHA-256 digest in docker-compose.yml.
- api/Dockerfile: python:3.11-slim and docker:27-cli pinned by digest.
- webui/Dockerfile: node:20-alpine and nginxinc/nginx-unprivileged:alpine pinned.
- ntp/Dockerfile: alpine:3.20 pinned by digest.
- wireguard/Dockerfile: alpine:3.20 pinned by digest.

Security — webui non-root:
- Switch from nginx:alpine (root, port 80) to nginxinc/nginx-unprivileged:alpine
  (port 8080, runs as nginx uid 101). Compose port mapping and all Caddy upstream
  references updated: cell-webui:80 → cell-webui:8080 everywhere.

API layer reduction (561 MB → 245 MB):
- Multi-stage api/Dockerfile: docker CLI copied from docker:27-cli stage instead
  of being installed via apt from Docker's external repo (removes GPG key fetch,
  lsb-release, gnupg, two apt-get update rounds). --no-install-recommends on
  remaining apt install. mkdir folded into the same RUN layer.

Bug fix — WireGuard config path mismatch:
- setup_cell.py wrote wg0.conf to config/wireguard/wg0.conf but wireguard_manager
  and the new entrypoint expect config/wireguard/wg_confs/wg0.conf (the standard
  wg-quick sub-directory). Fixed by creating the wg_confs/ sub-dir and writing
  there; REQUIRED_DIRS updated to pre-create it.

Bug fix — empty chrony.conf:
- config/ntp/chrony.conf was 0 bytes (pre-existing gap); added a real config
  (pool.ntp.org + Cloudflare, allow 172.20/10.0, local stratum 10, driftfile,
  makestep, rtcsync). NTP compose service now builds from ./ntp instead of
  pulling alpine:latest and running apk at every container start.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_caddy_manager.py

@@ -209,7 +209,7 @@ class TestServiceRoutesIncluded(unittest.TestCase):
         self.assertIn('reverse_proxy cell-filegator:8080', out)
         # Core routes still emitted
         self.assertIn('reverse_proxy cell-api:3000', out)
-        self.assertIn('reverse_proxy cell-webui:80', out)
+        self.assertIn('reverse_proxy cell-webui:8080', out)
 
 
 class TestReloadCaddyAdminAPI(unittest.TestCase):
@@ -218,7 +218,7 @@ class TestReloadCaddyAdminAPI(unittest.TestCase):
         # Point at a tmp Caddyfile so we can read it back during reload.
         import tempfile
         tmp = tempfile.NamedTemporaryFile('w', delete=False, suffix='.caddyfile')
-        tmp.write(":80 { reverse_proxy cell-webui:80 }\n")
+        tmp.write(":80 { reverse_proxy cell-webui:8080 }\n")
         tmp.close()
         mgr.caddyfile_path = tmp.name
 
@@ -232,7 +232,7 @@ class TestReloadCaddyAdminAPI(unittest.TestCase):
         # First positional arg is the URL
         self.assertEqual(args[0], 'http://cell-caddy:2019/load')
         self.assertEqual(kwargs['headers']['Content-Type'], 'text/caddyfile')
-        self.assertIn('cell-webui:80', kwargs['data'])
+        self.assertIn('cell-webui:8080', kwargs['data'])
         os.unlink(tmp.name)