Port upstream security fixes and features from ngoduykhanh/wireguard-ui

- Escape HTML in client list and wake-on-LAN names to prevent XSS
- Log successful/failed login attempts with remote address
- Fix leading-comma bug in AllowedIPs template when only extra allowed IPs are set
- Add PreUp script support for server interfaces (alongside existing PostUp/PreDown/PostDown)
- Fix endpoint parsing to support IPv6 addresses (upstream PR #223)

Cherry-picked from upstream PRs #656, #653, #680, #673, #223.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

main.go

@@ -27,7 +27,7 @@ import (
 
 var (
 	// command-line banner information
-	appVersion = "development"
+	appVersion = strings.TrimSpace(embeddedVersion)
 	gitCommit  = "N/A"
 	gitRef     = "N/A"
 	buildTime  = fmt.Sprintf(time.Now().UTC().Format("01-02-2006 15:04:05"))
@@ -74,6 +74,11 @@ var embeddedTemplates embed.FS
 //go:embed assets/*
 var embeddedAssets embed.FS
 
+// embed the VERSION file
+//
+//go:embed VERSION
+var embeddedVersion string
+
 func init() {
 	// command-line flags and env variables
 	flag.BoolVar(&flagDisableLogin, "disable-login", util.LookupEnvOrBool("DISABLE_LOGIN", flagDisableLogin), "Disable authentication on the app. This is potentially dangerous.")