Add wireguard-ui-multi core: multi-server DB, WireGuard manager, REST API, UI, installers

Implements the from-scratch multi-server WireGuard management fork per
CLAUDE.md spec: sqlite schema (servers/peers/audit_log/users), Curve25519
key generation, per-interface config rendering + wg-quick/systemd control,
nftables hook scaffolding, session+CSRF-protected REST API with QR code
and config download endpoints, a minimal vanilla-JS web UI, legacy
wg0.conf migration, and both a native installer and a Proxmox LXC
provisioning script (with auto-detected latest Debian template).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

systemd/wireguard-ui-multi.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=wireguard-ui-multi - native multi-server WireGuard management UI
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# Runs as root because it shells out to wg-quick, systemctl and nft, which
+# require CAP_NET_ADMIN (and in practice broad privileges for systemctl unit
+# management). AmbientCapabilities is set as defense-in-depth in case this
+# unit is ever adapted to run as a non-root user with File capabilities on
+# the binary instead.
+User=root
+Group=root
+AmbientCapabilities=CAP_NET_ADMIN
+ExecStart=/usr/local/bin/wireguard-ui-multi --db /var/lib/wireguard-ui-multi/wireguard-ui-multi.db --config-dir /etc/wireguard --hooks-dir /etc/wireguard-manager/hooks
+Restart=on-failure
+RestartSec=5
+WorkingDirectory=/var/lib/wireguard-ui-multi
+
+[Install]
+WantedBy=multi-user.target