Add process-local `WGInterfaceConfig` for key material, interface
addresses and peer-routing policy required by future provisioning.
Deats,
- redact private and preshared keys from representation
- block config from default actor-IPC encoding via `ProcessLocal`
- validate keys, interface CIDRs, allowed CIDRs and bounded integers
- keep public endpoint and peer identity in `WGTunnelSpec`
- move allowed-IP policy out of the serializable tunnel declaration
Prompt-IO: ai/prompt-io/opencode/20260825T234631Z_b973e78c_prompt_io.md
(this patch was generated in some part by `opencode` using `gpt-5.6-sol` (`openai`))
Gud Boi