fix: WireGuard sysctl || true, port check on page load, add peer status tests

Root cause: sysctl -q net.ipv4.conf.all.rp_filter=0 in PostUp exited non-zero
inside the linuxserver/wireguard container (no permission), causing wg-quick to
tear down the wg0 interface — breaking peer status, port check, and internet
access through full tunnel.

- wireguard_manager.py: add || true to both sysctl PostUp/PostDown lines
- docker-compose.yml: add net.ipv4.conf.all.rp_filter=0 to wireguard sysctls
- WireGuard.jsx: kick off port check asynchronously on page load (was refresh-only)
- tests: add TestWireGuardSysctlAndPortCheck — 14 new tests covering sysctl
  content, check_port_open (interface up / down / fallback-to-handshake),
  get_peer_status (online / offline / not-found / no-handshake), and
  get_all_peer_statuses (multi-peer / empty / skips interface line)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

webui/src/pages/WireGuard.jsx

@@ -53,7 +53,14 @@ function WireGuard() {
       ]);
 
       setStatus(statusResponse.data);
-      if (serverConfigResponse) setServerConfig(serverConfigResponse);
+      if (serverConfigResponse) {
+        setServerConfig({ ...serverConfigResponse, port_open: 'checking' });
+        // Check port asynchronously so page loads fast
+        fetch('/api/wireguard/check-port', { method: 'POST' })
+          .then(r => r.json())
+          .then(d => setServerConfig(prev => ({ ...prev, port_open: d.port_open ?? false })))
+          .catch(() => setServerConfig(prev => ({ ...prev, port_open: false })));
+      }
       
       // Merge peer registry data with WireGuard data (same as Peers page)
       const peersData = peersResponse.data || [];