Install takes over a pivpn WireGuard server

On a server running pivpn's WireGuard, a new install offers to take it
over: the server key, port, MTU, tunnel networks, endpoint, DNS,
AllowedIPs and keepalive, and every client with its public key,
preshared key and addresses. Devices keep their configs. Clients pivpn
switched off are imported switched off, with the note "Imported from
pivpn". Client private keys in /etc/wireguard/configs are not read.

- Install notes which peers are connected, stops wg-quick@wg0, starts
  GHOSTWIRE on the same wg0 and waits up to 30 s for those peers. The
  wait only reports; idle devices reconnect when they next send.
- If the service does not stay running, install removes what it set up,
  including config.json, and starts pivpn's WireGuard again.
- Without a terminal the takeover needs -import-pivpn; install refuses
  to run next to pivpn otherwise, and the flag is refused on an
  existing install.
- Names GHOSTWIRE does not accept are renamed and listed in the
  summary. An IPv6 address that differs from the mapped one is kept on
  the peer until its config is issued again.
- uninstall without a config of its own (e.g. after a takeover was
  undone) leaves the WireGuard interface alone and removes only the
  firewall table.
- README: "Coming from pivpn?" under the intro, a Features entry and a
  "Moving from pivpn" section.

Tested end to end on Ubuntu 24.04 with pivpn aa96de7.

api.go

@@ -560,7 +560,7 @@ func (a *App) patchServer(w http.ResponseWriter, r *http.Request) {
 	err = a.store.Update(func(c *Config) error {
 		s := &c.Server
 		before := s.clientFacing()
-		oldV4 := s.IPv4
+		oldV4, oldV6 := s.IPv4, s.IPv6
 		for _, f := range []struct {
 			key string
 			dst any
@@ -583,6 +583,11 @@ func (a *App) patchServer(w http.ResponseWriter, r *http.Request) {
 				return err
 			}
 		}
+		if s.IPv6 != oldV6 {
+			for i := range c.Peers {
+				c.Peers[i].IPv6 = "" // pivpn's addresses are in the old network
+			}
+		}
 		reissue = before != s.clientFacing()
 		return nil
 	})
@@ -703,7 +708,7 @@ func (a *App) peerView(c *Config, p *Peer) peerView {
 		Created:      p.Created, ConfigIssued: p.ConfigIssued, Setup: viewSetup(p.Setup), Stats: a.stats.Summary(p.ID),
 	}
 	if c.Server.IPv6Enabled {
-		v.IPv6 = mapIPv6(netip.MustParsePrefix(c.Server.IPv6), netip.MustParseAddr(p.IPv4)).String()
+		v.IPv6 = peerIPv6(c, p).String()
 	}
 	return v
 }
@@ -1037,7 +1042,8 @@ func (a *App) issueConfig(w http.ResponseWriter, r *http.Request) {
 		}
 		now := time.Now().UTC()
 		// A config issued here replaces any pending link.
-		p.PublicKey, p.ConfigIssued, p.Setup, name = pub, &now, nil, p.Name
+		// The new config gets the mapped IPv6 address.
+		p.PublicKey, p.ConfigIssued, p.Setup, p.IPv6, name = pub, &now, nil, "", p.Name
 		if p.PresharedKey != "" {
 			p.PresharedKey = psk.String()
 		}