Multi-interface management, topology view, performance tuning, precompiled CSS

- Interface model with per-interface subnet/port/keys; import/adopt existing wg-quick configs (key-less imported peers, optional key rotation), cascade delete
- Split wireguard.py into a package (keys via cryptography X25519, status, addressing, conf parse/render, sync, host tuning)
- ECharts horizontal topology view (interface -> peers -> site subnets)
- Advanced options: MTU, MSS clamping, FwMark/Table, custom PostUp/PostDown, per-peer keepalive override
- Runtime settings (sample interval/retention, online threshold, UI refresh) with traffic sample pruning; host tuning (UDP buffers, backlog, GRO forwarding)
- Precompiled Tailwind CSS replacing Play CDN runtime (fixes FOUC); stable table layout and diffed polling renders
- Host network mode in compose; NAT/isolation iptables moved into app sync

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

docker-compose.yml

@@ -5,17 +5,13 @@ services:
     restart: unless-stopped
     cap_add:
       - NET_ADMIN
-    sysctls:
-      - net.ipv4.ip_forward=1
-      - net.ipv4.conf.all.src_valid_mark=1
+    # Host networking: new interfaces and their UDP ports work without
+    # editing port mappings. The admin UI listens on host port 8000.
+    # Requires net.ipv4.ip_forward=1 on the host (sysctls cannot be set
+    # per-container in host network mode); entrypoint.sh enables it.
+    network_mode: host
     devices:
       - /dev/net/tun:/dev/net/tun
-    # For relay/组网 into host tunnels (WG_RELAY_SUBNETS), use host networking:
-    # uncomment network_mode and remove the ports section.
-    # network_mode: host
-    ports:
-      - "${WG_PORT:-51821}:${WG_PORT:-51821}/udp"
-      - "8000:8000/tcp"
     environment:
       WG_INTERFACE: ${WG_INTERFACE:-wg1}
       WG_HOST: ${WG_HOST:?set WG_HOST to your public IP or domain}
@@ -29,5 +25,5 @@ services:
       ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set ADMIN_PASSWORD in .env}
       SECRET_KEY: ${SECRET_KEY:?set SECRET_KEY in .env}
     volumes:
-      - ./wg-admin-data:/opt/wireguard-admin/data
-      - ./wg-config:/etc/wireguard
+      - ./volumes/admin-data:/opt/wireguard-admin/data
+      - ./volumes/config:/etc/wireguard