Rename the project to ihasvpn

WGX shares its name with several other WireGuard tools, so the project
becomes ihasvpn, alongside ihasmail.

- Module github.com/Coffey-Labs/ihasvpn, command cmd/ihasvpn, image
  ghcr.io/coffey-labs/ihasvpn.
- Environment variables move from WGX_* to IHASVPN_*. The default database
  is ihasvpn.db, the nftables table is `ihasvpn`, metrics are ihasvpn_*, and
  the session cookie and theme key are renamed, so existing sessions end.
- The mark is the ihasmail cat peeking over the edge of a shield, drawn as
  a vector. docs/brand/generate.py builds the mark, mono mark, wordmarks,
  social card, favicons and app icons from that one drawing.
- The console takes ihasmail's palette: the ihasmail.org teal-navy for dark,
  its contrast-checked light tiers with the site's light accent, received
  traffic in the cat's orange and sent in teal. The wordmark weight and
  font stack follow ihasmail.org.
- Detail values wrap at spaces before breaking inside an address, so an
  IPv6 tunnel address no longer splits mid-number.
- The README history note about the earlier WGX installer is gone with the
  name it explained. Screenshots retaken.

internal/wg/backend.go

@@ -1,5 +1,5 @@
 // Package wg abstracts the WireGuard data plane behind a small interface so the
-// rest of WGX does not care whether peers live in the kernel module, in a
+// rest of ihasvpn does not care whether peers live in the kernel module, in a
 // userspace wireguard-go process, or in an in-memory mock used by tests and
 // UI development.
 package wg
@@ -25,7 +25,7 @@ type PeerState struct {
 	PersistentKeepalive time.Duration
 }
 
-// PeerConfig is what WGX wants a peer to look like on the interface.
+// PeerConfig is what ihasvpn wants a peer to look like on the interface.
 type PeerConfig struct {
 	PublicKey           Key
 	PresharedKey        *Key
@@ -38,7 +38,7 @@ type DeviceConfig struct {
 	PrivateKey Key
 	ListenPort int
 	// FirewallMark is applied to every packet the interface sends; zero means
-	// none. Left at zero by WGX, but exposed for completeness.
+	// none. Left at zero by ihasvpn, but exposed for completeness.
 	FirewallMark int
 }
 
@@ -50,7 +50,7 @@ type DeviceState struct {
 	Peers      []PeerState
 }
 
-// Backend is the data plane WGX drives.
+// Backend is the data plane ihasvpn drives.
 type Backend interface {
 	// Kind names the implementation: "kernel", "userspace" or "mock".
 	Kind() string

internal/wg/linux.go

@@ -23,7 +23,7 @@ import (
 // linuxBackend drives a real WireGuard interface. In kernel mode the link is a
 // native `wireguard` netlink link and every packet is handled by the module;
 // in userspace mode a wireguard-go process owns a TUN device with the same
-// name and WGX talks to it over its UAPI socket. Both are configured through
+// name and ihasvpn talks to it over its UAPI socket. Both are configured through
 // wgctrl, which picks the transport on its own.
 type linuxBackend struct {
 	name      string
@@ -38,7 +38,7 @@ type linuxBackend struct {
 // trusting /sys/module, because a module that is loadable but not yet loaded
 // is only discovered by asking for it.
 func KernelAvailable() bool {
-	const probe = "wgxprobe0"
+	const probe = "ihasvpnprobe0"
 	link := &netlink.Wireguard{LinkAttrs: netlink.LinkAttrs{Name: probe}}
 	if err := netlink.LinkAdd(link); err != nil {
 		return false

internal/wg/mock.go

@@ -11,7 +11,7 @@ import (
 )
 
 // Mock is an in-memory data plane. It needs no privileges, so it is what the
-// tests use and what `WGX_BACKEND=mock` gives a developer working on the UI.
+// tests use and what `IHASVPN_BACKEND=mock` gives a developer working on the UI.
 // With Simulate on, peers randomly handshake, move traffic and go quiet so
 // the dashboard has something to show.
 type Mock struct {

internal/wg/other.go

@@ -7,7 +7,7 @@ import (
 	"log/slog"
 )
 
-var errLinuxOnly = errors.New("real WireGuard interfaces are only supported on Linux; use WGX_BACKEND=mock for development")
+var errLinuxOnly = errors.New("real WireGuard interfaces are only supported on Linux; use IHASVPN_BACKEND=mock for development")
 
 // KernelAvailable is always false off Linux.
 func KernelAvailable() bool { return false }