Site-to-site WireGuard tunnels between theta-gateway instances. Different from WireGuard, which manages individual roaming-client peers and exit nodes.
Give this to a new gateway so it can join this one's mesh (single-use, expires in 15 minutes). It calls this gateway's /api/mesh/register with it.
Have a join token from another gateway? Use it here to mesh THIS gateway into that one.