Add wireguard-ui-multi core: multi-server DB, WireGuard manager, REST API, UI, installers

Implements the from-scratch multi-server WireGuard management fork per
CLAUDE.md spec: sqlite schema (servers/peers/audit_log/users), Curve25519
key generation, per-interface config rendering + wg-quick/systemd control,
nftables hook scaffolding, session+CSRF-protected REST API with QR code
and config download endpoints, a minimal vanilla-JS web UI, legacy
wg0.conf migration, and both a native installer and a Proxmox LXC
provisioning script (with auto-detected latest Debian template).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/api/ui_handlers.go

@@ -0,0 +1,41 @@
+package api
+
+import (
+	"net/http"
+)
+
+const templatesDir = "internal/ui/templates"
+
+// hasSession reports whether the request carries a valid, non-expired session cookie.
+func (a *API) hasSession(r *http.Request) bool {
+	c, err := r.Cookie(sessionCookieName)
+	if err != nil {
+		return false
+	}
+	_, ok := a.sessions.Get(c.Value)
+	return ok
+}
+
+func (a *API) handleDashboard(w http.ResponseWriter, r *http.Request) {
+	if !a.hasSession(r) {
+		http.Redirect(w, r, "/login", http.StatusFound)
+		return
+	}
+	http.ServeFile(w, r, templatesDir+"/dashboard.html")
+}
+
+func (a *API) handleLoginPage(w http.ResponseWriter, r *http.Request) {
+	if a.hasSession(r) {
+		http.Redirect(w, r, "/", http.StatusFound)
+		return
+	}
+	http.ServeFile(w, r, templatesDir+"/login.html")
+}
+
+func (a *API) handleServerPage(w http.ResponseWriter, r *http.Request) {
+	if !a.hasSession(r) {
+		http.Redirect(w, r, "/login", http.StatusFound)
+		return
+	}
+	http.ServeFile(w, r, templatesDir+"/server.html")
+}