fix: full-tunnel default, real host routing table, peer config tunnel mode

- WireGuard default changed to full tunnel (0.0.0.0/0) — all peer traffic
  routes through PIC server so internet latency matches server's clean 41ms
- UI tunnel toggle now defaults to Full tunnel
- API /peers/config accepts allowed_ips param so UI toggle wires through
- Routing page reads real host routes via /proc/1/net/route (pid: host)
  instead of mock data; shows ens18/192.168.31.1 correctly
- Add iproute2 + util-linux to API Dockerfile

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -902,11 +902,13 @@ def get_peer_config():
             srv = wireguard_manager.get_server_config()
             server_endpoint = srv.get('endpoint') or '<SERVER_IP>'
 
+        allowed_ips = data.get('allowed_ips') or None
         result = wireguard_manager.get_peer_config(
             peer_name=peer_name,
             peer_ip=peer_ip,
             peer_private_key=peer_private_key,
             server_endpoint=server_endpoint,
+            allowed_ips=allowed_ips,
         )
         return jsonify({"config": result})
     except Exception as e: