Multi-interface management, topology view, performance tuning, precompiled CSS

- Interface model with per-interface subnet/port/keys; import/adopt existing wg-quick configs (key-less imported peers, optional key rotation), cascade delete
- Split wireguard.py into a package (keys via cryptography X25519, status, addressing, conf parse/render, sync, host tuning)
- ECharts horizontal topology view (interface -> peers -> site subnets)
- Advanced options: MTU, MSS clamping, FwMark/Table, custom PostUp/PostDown, per-peer keepalive override
- Runtime settings (sample interval/retention, online threshold, UI refresh) with traffic sample pruning; host tuning (UDP buffers, backlog, GRO forwarding)
- Precompiled Tailwind CSS replacing Play CDN runtime (fixes FOUC); stable table layout and diffed polling renders
- Host network mode in compose; NAT/isolation iptables moved into app sync

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

app/templates/topology.html

@@ -0,0 +1,22 @@
+{% extends "base.html" %}
+{% block title %}Topology - WireGuard Admin{% endblock %}
+{% block breadcrumbs %}<span>/</span> <span>Topology</span>{% endblock %}
+{% block content %}
+<div class="mb-6 flex items-center justify-between">
+  <h1 class="text-2xl font-bold">Network Topology</h1>
+  <div id="isolation-badge"></div>
+</div>
+
+<div class="rounded-xl bg-white p-4 shadow-sm">
+  <div id="topology-chart" class="w-full" style="height: 560px;"></div>
+</div>
+
+<p class="mt-3 text-sm text-slate-500">
+  Left to right: interface, peers, site subnets. Dashed links mean the peer is offline or disabled.
+  Scroll to zoom, drag to pan, click a peer to open its detail page.
+</p>
+{% endblock %}
+{% block scripts %}
+<script src="/static/echarts.min.js"></script>
+<script src="/static/topology.js"></script>
+{% endblock %}