feat: local Mullvad WireGuard + policy routing for guest traffic

- parahub-mullvad script: setup/status/remove for owner's Mullvad key
- WireGuard packages: kmod-wireguard, wireguard-tools, luci-proto-wireguard
- Policy routing: ip4table='100' + guest subnet rule (fixes guest→VPN flow)
- setup: auto-detects country, registers key, creates WG interface, switches firewall
- remove: reverts to GRE6→VPS gateway

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

files/etc/uci-defaults/99-parahub-mesh

@@ -132,6 +132,13 @@ set network.vpn_tunnel.ipaddr='172.16.0.2'
 set network.vpn_tunnel.netmask='255.255.255.0'
 set network.vpn_tunnel.gateway='172.16.0.1'
 set network.vpn_tunnel.mtu='1400'
+set network.vpn_tunnel.ip4table='100'
+
+# --- Policy routing: guest traffic → VPN table 100 ---
+add network rule
+set network.@rule[-1].src='${GUEST_SUBNET}/24'
+set network.@rule[-1].lookup='100'
+set network.@rule[-1].priority='100'
 NET_EOF
 uci commit network