WireGuard server with an embedded admin console

Go backend that drives kernel WireGuard over netlink (wireguard-go as the
fallback), nftables NAT with MSS clamping, forwarding and buffer sysctls,
SQLite for peers, users, sessions, traffic history and the audit log.

React console: dashboard with live rates and usage history, peer management
with QR codes and .conf downloads, disconnect, session reset, key rotation,
expiry, client-supplied keys, settings, users with admin and viewer roles,
two-factor authentication with recovery codes, audit log.

Docker image on Alpine with compose files for bridged and host networking,
CI and GHCR publish workflows, performance notes.

internal/wg/other.go

@@ -0,0 +1,19 @@
+//go:build !linux
+
+package wg
+
+import (
+	"errors"
+	"log/slog"
+)
+
+var errLinuxOnly = errors.New("real WireGuard interfaces are only supported on Linux; use WGX_BACKEND=mock for development")
+
+// KernelAvailable is always false off Linux.
+func KernelAvailable() bool { return false }
+
+// NewKernel is unavailable off Linux.
+func NewKernel(name string, log *slog.Logger) (Backend, error) { return nil, errLinuxOnly }
+
+// NewUserspace is unavailable off Linux.
+func NewUserspace(name string, log *slog.Logger) (Backend, error) { return nil, errLinuxOnly }