WireGuard server with an embedded admin console

Go backend that drives kernel WireGuard over netlink (wireguard-go as the
fallback), nftables NAT with MSS clamping, forwarding and buffer sysctls,
SQLite for peers, users, sessions, traffic history and the audit log.

React console: dashboard with live rates and usage history, peer management
with QR codes and .conf downloads, disconnect, session reset, key rotation,
expiry, client-supplied keys, settings, users with admin and viewer roles,
two-factor authentication with recovery codes, audit log.

Docker image on Alpine with compose files for bridged and host networking,
CI and GHCR publish workflows, performance notes.

NOTICE

@@ -0,0 +1,35 @@
+# Third-party notices
+
+WGX is licensed under the AGPL-3.0; see LICENSE. This file records work by
+other people that ships inside the binary and the image, and the terms it
+comes under. Each project's own licence text travels with it in the Go module
+cache and in web/node_modules and is not repeated here.
+
+## Go
+
+| Module | Licence |
+| --- | --- |
+| golang.zx2c4.com/wireguard/wgctrl (and golang.zx2c4.com/wireguard) | MIT, Matt Layher / Jason A. Donenfeld |
+| github.com/mdlayher/netlink, genetlink, socket | MIT, Matt Layher |
+| github.com/vishvananda/netlink, netns | Apache-2.0 |
+| modernc.org/sqlite, libc, mathutil, memory | BSD-3-Clause |
+| github.com/skip2/go-qrcode | MIT, Tom Harwood |
+| golang.org/x/crypto, x/sys, x/net, x/sync, x/term | BSD-3-Clause, The Go Authors |
+
+## JavaScript (built into the console)
+
+| Package | Licence |
+| --- | --- |
+| react, react-dom | MIT, Meta Platforms |
+| wouter | Unlicense |
+| lucide-react | ISC, Lucide Contributors |
+
+## Runtime image
+
+The container image is built on Alpine Linux and ships nftables,
+wireguard-tools and wireguard-go from its package repositories, each under
+its own licence (GPL-2.0 for nftables and wireguard-tools, MIT for
+wireguard-go). They are separate programs invoked by WGX, not linked into it.
+
+WireGuard is a registered trademark of Jason A. Donenfeld. WGX is not
+affiliated with or endorsed by the WireGuard project.