Add wireguard-ui-multi core: multi-server DB, WireGuard manager, REST API, UI, installers

Implements the from-scratch multi-server WireGuard management fork per
CLAUDE.md spec: sqlite schema (servers/peers/audit_log/users), Curve25519
key generation, per-interface config rendering + wg-quick/systemd control,
nftables hook scaffolding, session+CSRF-protected REST API with QR code
and config download endpoints, a minimal vanilla-JS web UI, legacy
wg0.conf migration, and both a native installer and a Proxmox LXC
provisioning script (with auto-detected latest Debian template).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/install.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Idempotent installer for wireguard-ui-multi. Expects the binary to already be
+# built at ./wireguard-ui-multi (run `go build ./cmd/wireguard-ui-multi` first).
+set -euo pipefail
+
+BIN_SRC="./wireguard-ui-multi"
+BIN_DST="/usr/local/bin/wireguard-ui-multi"
+CONFIG_DIR="/etc/wireguard-ui-multi"
+DATA_DIR="/var/lib/wireguard-ui-multi"
+HOOKS_DIR="/etc/wireguard-manager/hooks"
+SERVICE_SRC="systemd/wireguard-ui-multi.service"
+SERVICE_DST="/etc/systemd/system/wireguard-ui-multi.service"
+
+if [[ "$(id -u)" -ne 0 ]]; then
+	echo "This installer must be run as root (it writes to /usr/local/bin, /etc, /var/lib)." >&2
+	exit 1
+fi
+
+if [[ ! -f "$BIN_SRC" ]]; then
+	if [[ -d "./cmd/wireguard-ui-multi" ]] && command -v go >/dev/null 2>&1; then
+		echo "Binary not found, building from source with 'go build'..."
+		go build -o "$BIN_SRC" ./cmd/wireguard-ui-multi
+	else
+		echo "Binary not found at $BIN_SRC and cannot build (need Go toolchain + source). Build it first, e.g.:" >&2
+		echo "  go build -o wireguard-ui-multi ./cmd/wireguard-ui-multi" >&2
+		exit 1
+	fi
+fi
+
+echo "Creating directories..."
+mkdir -p /usr/local/bin
+mkdir -p "$CONFIG_DIR"
+mkdir -p "$DATA_DIR"
+mkdir -p "$HOOKS_DIR"
+
+echo "Installing binary to $BIN_DST..."
+cp "$BIN_SRC" "$BIN_DST"
+chmod 0755 "$BIN_DST"
+
+echo "Installing systemd unit to $SERVICE_DST..."
+cp "$SERVICE_SRC" "$SERVICE_DST"
+systemctl daemon-reload
+
+# The database holds bcrypt password hashes; keep the directory private.
+echo "Restricting permissions on $DATA_DIR (0700)..."
+chmod 0700 "$DATA_DIR"
+
+echo
+echo "Installation complete."
+echo "This script does NOT start the service automatically. To enable and start it, run:"
+echo
+echo "  systemctl enable --now wireguard-ui-multi.service"
+echo
+echo "Then check status with:"
+echo
+echo "  systemctl status wireguard-ui-multi.service"
+echo "  journalctl -u wireguard-ui-multi.service -f"