OpenWrt's WireGuard proto handler doesn't support private_key_file — it auto-generates a new key, causing mismatch with the heartbeat pubkey. Read key from file and set as inline private_key instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>