release(v2.1.0): gateway-to-gateway WireGuard mesh, mDNS announce, mesh UI

Rolls up this pass's mesh work: real site-to-site WireGuard tunnels
(kernel-first, wireguard-go fallback), join-token bootstrap, mDNS
local-discovery announcer, and a UI for all of it. Verified with real
two-container tests (actual encrypted tunnel passing traffic, real
multicast discovery cycle), which caught two real bugs -- see
CHANGELOG.md for detail.

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "theta-gateway",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "SSH jump host for the theta42 stack — LDAP-authenticated, directory-driven host bridging with audit and metrics",
   "author": [
     {