Add wireguard-ui-multi core: multi-server DB, WireGuard manager, REST API, UI, installers

Implements the from-scratch multi-server WireGuard management fork per
CLAUDE.md spec: sqlite schema (servers/peers/audit_log/users), Curve25519
key generation, per-interface config rendering + wg-quick/systemd control,
nftables hook scaffolding, session+CSRF-protected REST API with QR code
and config download endpoints, a minimal vanilla-JS web UI, legacy
wg0.conf migration, and both a native installer and a Proxmox LXC
provisioning script (with auto-detected latest Debian template).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/api/router.go

@@ -0,0 +1,86 @@
+package api
+
+import (
+	"log/slog"
+	"net/http"
+
+	"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/database"
+	"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/server"
+)
+
+// API holds shared dependencies for HTTP handlers.
+type API struct {
+	db       *database.DB
+	store    *server.Store
+	sessions *SessionStore
+	log      *slog.Logger
+	lanIface string
+}
+
+func New(db *database.DB, log *slog.Logger, lanIface string) *API {
+	return &API{
+		db:       db,
+		store:    server.NewStore(db),
+		sessions: NewSessionStore(),
+		log:      log,
+		lanIface: lanIface,
+	}
+}
+
+// Routes builds the full HTTP handler tree (API + UI), using Go 1.22 mux patterns.
+func (a *API) Routes() http.Handler {
+	mux := http.NewServeMux()
+
+	// Auth
+	mux.HandleFunc("POST /api/login", a.handleLogin)
+	mux.HandleFunc("POST /api/logout", a.withAuth(a.handleLogout))
+
+	// Servers
+	mux.HandleFunc("GET /api/servers", a.withAuth(a.handleListServers))
+	mux.HandleFunc("POST /api/servers", a.withAuth(a.handleCreateServer))
+	mux.HandleFunc("GET /api/servers/{id}", a.withAuth(a.handleGetServer))
+	mux.HandleFunc("PUT /api/servers/{id}", a.withAuth(a.handleUpdateServer))
+	mux.HandleFunc("DELETE /api/servers/{id}", a.withAuth(a.handleDeleteServer))
+	mux.HandleFunc("POST /api/servers/{id}/start", a.withAuth(a.handleStartServer))
+	mux.HandleFunc("POST /api/servers/{id}/stop", a.withAuth(a.handleStopServer))
+	mux.HandleFunc("POST /api/servers/{id}/reload", a.withAuth(a.handleReloadServer))
+	mux.HandleFunc("GET /api/servers/{id}/config", a.withAuth(a.handleDownloadServerConfig))
+
+	// Peers
+	mux.HandleFunc("GET /api/server/{id}/peers", a.withAuth(a.handleListPeers))
+	mux.HandleFunc("POST /api/server/{id}/peer", a.withAuth(a.handleCreatePeer))
+	mux.HandleFunc("DELETE /api/server/{id}/peer/{peerid}", a.withAuth(a.handleDeletePeer))
+	mux.HandleFunc("GET /api/server/{id}/peer/{peerid}/config", a.withAuth(a.handleDownloadPeerConfig))
+	mux.HandleFunc("GET /api/server/{id}/peer/{peerid}/qrcode", a.withAuth(a.handlePeerQRCode))
+
+	// UI
+	mux.HandleFunc("GET /", a.handleDashboard)
+	mux.HandleFunc("GET /login", a.handleLoginPage)
+	mux.HandleFunc("GET /servers/{id}", a.handleServerPage)
+	mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.Dir("internal/ui/static"))))
+
+	return a.logMiddleware(mux)
+}
+
+func (a *API) logMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		a.log.Info("request", "method", r.Method, "path", r.URL.Path, "remote", r.RemoteAddr)
+		next.ServeHTTP(w, r)
+	})
+}
+
+// withAuth enforces a valid session and, for mutating requests, a matching CSRF token.
+func (a *API) withAuth(next func(http.ResponseWriter, *http.Request, *session)) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		sess, err := a.requireAuth(r)
+		if err != nil {
+			http.Error(w, "unauthenticated", http.StatusUnauthorized)
+			return
+		}
+		if !requireCSRF(sess, r) {
+			http.Error(w, "invalid csrf token", http.StatusForbidden)
+			return
+		}
+		next(w, r, sess)
+	}
+}