fix: add /api/network/dns/corefile endpoint and per-line iptables check

The e2e tests were reading a stale Corefile at a hardcoded fallback path
(/home/roof/pic/config/dns/Corefile) instead of the live one written by
the API (/opt/pic/config/dns/Corefile on pic1). Adding a proper API
endpoint eliminates the path ambiguity.

The iptables test was checking whether peer_ip, DROP, and dpt:80 appeared
anywhere in the full multi-line output rather than on the same rule line,
producing false positives. Now checks per line.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routes/network.py

@@ -1,5 +1,6 @@
 import logging
-from flask import Blueprint, request, jsonify
+import os
+from flask import Blueprint, request, jsonify, Response
 logger = logging.getLogger('picell')
 bp = Blueprint('network', __name__)
 
@@ -99,6 +100,20 @@ def get_dns_status():
         logger.error(f"Error getting DNS status: {e}")
         return jsonify({"error": str(e)}), 500
 
+@bp.route('/api/network/dns/corefile', methods=['GET'])
+def get_corefile():
+    try:
+        from app import COREFILE_PATH
+        with open(COREFILE_PATH, 'r') as f:
+            content = f.read()
+        return Response(content, mimetype='text/plain')
+    except FileNotFoundError:
+        return Response('', mimetype='text/plain'), 404
+    except Exception as e:
+        logger.error(f"Error reading Corefile: {e}")
+        return jsonify({"error": str(e)}), 500
+
+
 @bp.route('/api/network/test', methods=['POST'])
 def test_network():
     try: