Port upstream security fixes and features from ngoduykhanh/wireguard-ui

- Escape HTML in client list and wake-on-LAN names to prevent XSS
- Log successful/failed login attempts with remote address
- Fix leading-comma bug in AllowedIPs template when only extra allowed IPs are set
- Add PreUp script support for server interfaces (alongside existing PostUp/PreDown/PostDown)
- Fix endpoint parsing to support IPv6 addresses (upstream PR #223)

Cherry-picked from upstream PRs #656, #653, #680, #673, #223.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

handler/routes.go

@@ -106,7 +106,7 @@ func Login(db store.IStore) echo.HandlerFunc {
 
 		dbuser, err := db.GetUserByName(username)
 		if err != nil {
-			log.Infof("Cannot query user %s from DB", username)
+			log.Warnf("Invalid credentials. Cannot query user %s from DB (%s)", username, c.Request().RemoteAddr)
 			return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Invalid credentials"})
 		}
 
@@ -161,9 +161,11 @@ func Login(db store.IStore) echo.HandlerFunc {
 			cookie.SameSite = http.SameSiteLaxMode
 			c.SetCookie(cookie)
 
+			log.Infof("Logged in successfully user %s (%s)", username, c.Request().RemoteAddr)
 			return c.JSON(http.StatusOK, jsonHTTPResponse{true, "Logged in successfully"})
 		}
 
+		log.Warnf("Invalid credentials user %s (%s)", username, c.Request().RemoteAddr)
 		return c.JSON(http.StatusUnauthorized, jsonHTTPResponse{false, "Invalid credentials"})
 	}
 }