feat(wireguard): WireGuard peer manager UI — QR codes, .conf download, per-client exit node selection (#42)

* feat(wireguard): WireGuard peer manager UI with QR, .conf download, and per-client exit node selection

- models/wg_peer.js     — Redis-backed peer store with auto IP allocation (10.100.0.x)
- models/wg_site.js     — Redis-backed exit node store (admin-managed sites)
- utils/wg_keys.js      — X25519 keypair gen via Node crypto (no wg binary needed)
- utils/wg_conf.js      — client wg0.conf renderer
- routes/wireguard.js   — REST API: CRUD sites/peers, GET /conf, GET /qr (QRCode PNG)
- views/wireguard.ejs   — full dark-mode UI: exit node table, peer table, QR modal,
                           .conf download, exit node picker per client
- conf/base.js          — conf.wireguard block (serverPublicKey, serverEndpoint, dns, poolBase)
- Nav: WireGuard link added (admin-gated)
- No wg binary dep in Node process — key gen is pure JS X25519

* fix(test): update test script to run unit tests without native bcrypt binary dependency in CI

* fix(ui): replace native browser alert/confirm with app.messages in WireGuard view

nodejs/conf/base.js

@@ -120,4 +120,20 @@ module.exports = {
 
 	// Orchestrator-only keys (ignored by the app, read by theta-env).
 	stack: {},
+
+	// WireGuard mesh configuration.
+	// These values describe this gateway's own wg0 interface so the web UI
+	// can show the server public key and build client profiles.
+	// Override via environment: app_wireguard__serverPublicKey, etc.
+	wireguard: {
+		// Public key of this gateway's wg0 interface (set at runtime by docker-entrypoint).
+		serverPublicKey: '',
+		// "host:port" that WireGuard clients connect to, e.g. "gw.theta42.com:51820".
+		serverEndpoint: '',
+		// DNS server to push to clients, e.g. "10.1.0.1" or leave empty for none.
+		dns: '',
+		// Base of the IP pool for peer assignment: first two octets.
+		// Peers are assigned 10.100.0.2, 10.100.0.3, …, 10.100.255.254.
+		poolBase: '10.100.0',
+	},
 };