security: replace WireGuard catch-all ACCEPT with DROP

The PostUp rule appended `iptables -A FORWARD -i wg0 -j ACCEPT` which
allowed any WireGuard-connected client full internet access regardless of
per-peer rules, even when no peers were configured in wg0.conf.

Fix: change PostUp/PostDown to use DROP as the catch-all. Per-peer and
per-cell rules use -I (insert at top) so they take precedence; unknown
or unconfigured WG traffic hits the DROP at the bottom.

Also add reconcile_stale_peer_rules() called on startup to remove FORWARD
rules for peer IPs that no longer exist in the registry, preventing deleted
peers from retaining firewall access across container restarts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_wireguard_manager.py

@@ -480,9 +480,10 @@ class TestWireGuardSysctlAndPortCheck(unittest.TestCase):
         cfg = self.wg.generate_config()
         self.assertIn('MASQUERADE', cfg)
 
-    def test_generate_config_has_forward_rule(self):
+    def test_generate_config_has_forward_drop_rule(self):
         cfg = self.wg.generate_config()
-        self.assertIn('FORWARD -i %i -j ACCEPT', cfg)
+        self.assertIn('FORWARD -i %i -j DROP', cfg)
+        self.assertNotIn('FORWARD -i %i -j ACCEPT', cfg)
 
     # ── check_port_open ───────────────────────────────────────────────────────