Multi-interface management, topology view, performance tuning, precompiled CSS

- Interface model with per-interface subnet/port/keys; import/adopt existing wg-quick configs (key-less imported peers, optional key rotation), cascade delete
- Split wireguard.py into a package (keys via cryptography X25519, status, addressing, conf parse/render, sync, host tuning)
- ECharts horizontal topology view (interface -> peers -> site subnets)
- Advanced options: MTU, MSS clamping, FwMark/Table, custom PostUp/PostDown, per-peer keepalive override
- Runtime settings (sample interval/retention, online threshold, UI refresh) with traffic sample pruning; host tuning (UDP buffers, backlog, GRO forwarding)
- Precompiled Tailwind CSS replacing Play CDN runtime (fixes FOUC); stable table layout and diffed polling renders
- Host network mode in compose; NAT/isolation iptables moved into app sync

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

app/wireguard/keys.py

@@ -0,0 +1,24 @@
+import base64
+import secrets
+
+from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
+
+
+def genkey() -> str:
+    private = X25519PrivateKey.generate()
+    return base64.b64encode(private.private_bytes_raw()).decode()
+
+
+def genpsk() -> str:
+    return base64.b64encode(secrets.token_bytes(32)).decode()
+
+
+def pubkey(private_key: str) -> str:
+    raw = base64.b64decode(private_key)
+    public = X25519PrivateKey.from_private_bytes(raw).public_key()
+    return base64.b64encode(public.public_bytes_raw()).decode()
+
+
+def generate_keypair() -> tuple[str, str]:
+    private = genkey()
+    return private, pubkey(private)