fix: full-tunnel default, real host routing table, peer config tunnel mode

- WireGuard default changed to full tunnel (0.0.0.0/0) — all peer traffic
  routes through PIC server so internet latency matches server's clean 41ms
- UI tunnel toggle now defaults to Full tunnel
- API /peers/config accepts allowed_ips param so UI toggle wires through
- Routing page reads real host routes via /proc/1/net/route (pid: host)
  instead of mock data; shows ens18/192.168.31.1 correctly
- Add iproute2 + util-linux to API Dockerfile

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

webui/src/pages/WireGuard.jsx

@@ -16,7 +16,7 @@ function WireGuard() {
   const [peerConfig, setPeerConfig] = useState('');
   const [qrCodeDataUrl, setQrCodeDataUrl] = useState('');
   const [peerStatuses, setPeerStatuses] = useState({});
-  const [tunnelMode, setTunnelMode] = useState('split'); // 'split' or 'full'
+  const [tunnelMode, setTunnelMode] = useState('full'); // 'split' or 'full'
 
   useEffect(() => {
     fetchWireGuardData();