29029914d2
Rolls up this pass's mesh work: real site-to-site WireGuard tunnels (kernel-first, wireguard-go fallback), join-token bootstrap, mDNS local-discovery announcer, and a UI for all of it. Verified with real two-container tests (actual encrypted tunnel passing traffic, real multicast discovery cycle), which caught two real bugs -- see CHANGELOG.md for detail.