refactor: Remove GRE tunnels, add Mullvad gateway health check

Radical simplification — no more VPS data plane:
- Delete parahub-vpn-tunnel init script (GRE6 no longer used)
- Revert heartbeat to clean version (no tunnel_ip parsing)
- Add parahub-gw-check: monitors WireGuard handshake, switches
  batman-adv gw_mode between server/client (cron every 2 min)
- Update uci-defaults: remove vpn_tunnel zone/interface, start
  bumblebee as gw_mode=client (health check promotes to server)

Guest internet now requires Mullvad — kill switch by design.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

files/etc/init.d/parahub-vpn-tunnel

@@ -1,97 +0,0 @@
-#!/bin/sh /etc/rc.common
-# Parahub VPN Tunnel — Creates GRE6 tunnel over Yggdrasil for guest traffic
-# Runs after yggdrasil (START=95). OpenWrt 25.x lacks the netifd grev6 protocol
-# handler, so we create the tunnel manually with ip6gre.
-#
-# Tunnel IP is assigned by Django and stored in /etc/parahub/tunnel_ip.
-# If the file doesn't exist (first boot), heartbeat is called synchronously to get it.
-#
-# IMPORTANT: encaplimit must be "none" — Yggdrasil drops IPv6 packets with
-# Destination Options extension headers (added by default encaplimit 4).
-
-START=96
-STOP=10
-
-VPS_YGG="200:39f1:6a26:328a:d901:fbd2:d30d:faef"
-GRE_GATEWAY="172.16.0.1"
-TUNNEL_IP_FILE="/etc/parahub/tunnel_ip"
-
-start() {
-    # Only for Bumblebee role
-    [ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || return 0
-
-    # Wait for Yggdrasil address (up to 60s)
-    local ygg_addr="" attempts=0
-    while [ $attempts -lt 30 ]; do
-        ygg_addr=$(ip -6 addr show dev ygg0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
-        [ -n "$ygg_addr" ] && break
-        attempts=$((attempts + 1))
-        sleep 2
-    done
-
-    if [ -z "$ygg_addr" ]; then
-        logger -t parahub-vpn "No Yggdrasil address after 60s, skipping GRE6 tunnel"
-        return 1
-    fi
-
-    # Get tunnel IP — from file, or request via heartbeat on first boot
-    local gre_local_ip
-    gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null)
-
-    if [ -z "$gre_local_ip" ]; then
-        logger -t parahub-vpn "No tunnel IP file, calling heartbeat to get assignment..."
-        HEARTBEAT_CURL_TIMEOUT=30 /usr/bin/parahub-heartbeat
-        gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null)
-    fi
-
-    if [ -z "$gre_local_ip" ]; then
-        logger -t parahub-vpn "Failed to get tunnel IP from heartbeat, falling back to 172.16.0.2"
-        gre_local_ip="172.16.0.2"
-    fi
-
-    # Create GRE6 tunnel (encaplimit none — critical for Yggdrasil compatibility)
-    ip -6 tunnel add gre6-vpn mode ip6gre \
-        remote "$VPS_YGG" \
-        local "$ygg_addr" \
-        encaplimit none
-    ip addr add ${gre_local_ip}/24 dev gre6-vpn
-    ip link set gre6-vpn mtu 1400 up
-
-    # Default route through GRE (table 100 — used by guest policy routing)
-    ip route add default via "$GRE_GATEWAY" table 100
-
-    # Guest subnet direct route in table 100 (background — WiFi may not be up yet)
-    # Without this, router's own replies (source IP in guest subnet) go through
-    # GRE instead of back to the guest client (ip rule matches source-based)
-    local guest_subnet
-    guest_subnet=$(awk -F= '/GUEST_SUBNET/{print $2}' /etc/parahub/keys 2>/dev/null)
-    if [ -n "$guest_subnet" ]; then
-        # WiFi interfaces take time to come up at boot — retry in background
-        (
-            local guest_dev="" ga=0
-            while [ $ga -lt 30 ]; do
-                guest_dev=$(ip route | grep "^${guest_subnet} " | awk '{print $3}')
-                [ -n "$guest_dev" ] && break
-                ga=$((ga + 1))
-                sleep 2
-            done
-            if [ -n "$guest_dev" ]; then
-                ip route add "$guest_subnet" dev "$guest_dev" table 100 2>/dev/null
-                logger -t parahub-vpn "Guest route: $guest_subnet via $guest_dev in table 100"
-            else
-                logger -t parahub-vpn "Warning: guest device not found for $guest_subnet after 60s"
-            fi
-        ) &
-    fi
-
-    # Reload firewall so vpn_tunnel zone picks up gre6-vpn device
-    /etc/init.d/firewall reload 2>/dev/null &
-
-    logger -t parahub-vpn "GRE6 tunnel up: ${gre_local_ip} → ${VPS_YGG} via $ygg_addr (encaplimit none)"
-}
-
-stop() {
-    ip route flush table 100 2>/dev/null
-    ip -6 tunnel del gre6-vpn 2>/dev/null
-    logger -t parahub-vpn "GRE6 tunnel down"
-}