Harden WireGuard private-network transport to the supported contract #274

Decision

Transport scope T5: retain and harden WireGuard as a first-class private-network transport.

Definition of success

Parity means Onibi reliably uses an already user-managed WireGuard network; it does not configure peers, keys, server infrastructure, or WireGuard policy.

Required behavior

• Deterministically select a routable WireGuard interface/address, with a clear explicit override for ambiguous hosts.
• Bind the Cockpit only to that selected private address and include it in the certificate/QR URL.
• Revalidate interface/address health; fail closed on stale or changed network state rather than serving a stale endpoint.
• Provide actionable doctor diagnostics and real-phone pairing/reconnect coverage.
• Never modify WireGuard configuration, keys, peers, or routes.

Acceptance criteria

• A configured phone and host can pair and use terminal/approval/reconnect flows over WireGuard with the same owner-auth model as LAN/Tailscale Private.
• Selection, certificate, address-change, error, and cleanup paths are tested and documented.