fix(wg): Use private_key instead of private_key_file (unsupported)

OpenWrt's WireGuard proto handler doesn't support private_key_file —
it auto-generates a new key, causing mismatch with the heartbeat pubkey.
Read key from file and set as inline private_key instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

files/etc/uci-defaults/99-parahub-mesh

@@ -241,7 +241,7 @@ set network.wan.proto='dhcp'
 # --- VPS gateway WireGuard (disabled until heartbeat activates it) ---
 set network.vps_gateway=interface
 set network.vps_gateway.proto='wireguard'
-set network.vps_gateway.private_key_file='/etc/parahub/wg_vps_private.key'
+set network.vps_gateway.private_key='$(cat /etc/parahub/wg_vps_private.key)'
 set network.vps_gateway.mtu='1420'
 set network.vps_gateway.ip4table='100'
 set network.vps_gateway.auto='0'

files/usr/bin/parahub-heartbeat

@@ -19,6 +19,14 @@ UPTIME="$(cut -d. -f1 /proc/uptime)"
 MESH_IP=$(ip -4 addr show br-private 2>/dev/null | grep -o 'inet [0-9.]*' | cut -d' ' -f2)
 MESH_IP="${MESH_IP:-unknown}"
 
+# Generate WireGuard VPS keypair if missing (OTA from pre-VPS firmware)
+if [ "$ROLE" != "bee" ] && [ ! -f /etc/parahub/wg_vps_private.key ] && command -v wg >/dev/null 2>&1; then
+    umask 077
+    wg genkey > /etc/parahub/wg_vps_private.key
+    wg pubkey < /etc/parahub/wg_vps_private.key > /etc/parahub/wg_vps_public.key
+    logger -t parahub-heartbeat "Generated VPS WireGuard keypair (OTA migration)"
+fi
+
 # Read WireGuard VPS public key (Bumblebee only)
 WG_PUBKEY=""
 if [ -f /etc/parahub/wg_vps_public.key ]; then

files/usr/bin/parahub-mullvad

@@ -95,8 +95,8 @@ cmd_setup() {
     # --- Step 2: Register with Mullvad API ---
     echo "Registering key with Mullvad..."
     RESULT=$(curl -s --max-time 15 -X POST https://api.mullvad.net/wg/ \
-        -d "account=$ACCOUNT" \
-        -d "pubkey=$PUBKEY")
+        --data-urlencode "account=$ACCOUNT" \
+        --data-urlencode "pubkey=$PUBKEY")
 
     if echo "$RESULT" | grep -q "^[0-9]"; then
         MULLVAD_IPV4=$(echo "$RESULT" | cut -d',' -f1)

files/usr/bin/parahub-vps-setup

@@ -36,7 +36,7 @@ if ! uci -q get network.vps_gateway >/dev/null 2>&1; then
     uci batch <<-BOOTSTRAP_NET
 set network.vps_gateway=interface
 set network.vps_gateway.proto='wireguard'
-set network.vps_gateway.private_key_file='/etc/parahub/wg_vps_private.key'
+set network.vps_gateway.private_key='$(cat /etc/parahub/wg_vps_private.key)'
 set network.vps_gateway.mtu='1420'
 set network.vps_gateway.ip4table='100'
 BOOTSTRAP_NET