Install takes over a pivpn WireGuard server

On a server running pivpn's WireGuard, a new install offers to take it
over: the server key, port, MTU, tunnel networks, endpoint, DNS,
AllowedIPs and keepalive, and every client with its public key,
preshared key and addresses. Devices keep their configs. Clients pivpn
switched off are imported switched off, with the note "Imported from
pivpn". Client private keys in /etc/wireguard/configs are not read.

- Install notes which peers are connected, stops wg-quick@wg0, starts
  GHOSTWIRE on the same wg0 and waits up to 30 s for those peers. The
  wait only reports; idle devices reconnect when they next send.
- If the service does not stay running, install removes what it set up,
  including config.json, and starts pivpn's WireGuard again.
- Without a terminal the takeover needs -import-pivpn; install refuses
  to run next to pivpn otherwise, and the flag is refused on an
  existing install.
- Names GHOSTWIRE does not accept are renamed and listed in the
  summary. An IPv6 address that differs from the mapped one is kept on
  the peer until its config is issued again.
- uninstall without a config of its own (e.g. after a takeover was
  undone) leaves the WireGuard interface alone and removes only the
  firewall table.
- README: "Coming from pivpn?" under the intro, a Features entry and a
  "Moving from pivpn" section.

Tested end to end on Ubuntu 24.04 with pivpn aa96de7.

ipam.go

@@ -122,6 +122,15 @@ func nextFreeIPv4(c *Config) (netip.Addr, error) {
 // capacity is the number of peer addresses in the tunnel network.
 func capacity(n netip.Prefix) int { return 1<<(32-n.Bits()) - 3 }
 
+// peerIPv6 is the peer's IPv6 tunnel address: the one kept from pivpn, or
+// the one mapped from its IPv4 address.
+func peerIPv6(c *Config, p *Peer) netip.Addr {
+	if a, err := netip.ParseAddr(p.IPv6); err == nil {
+		return a
+	}
+	return mapIPv6(netip.MustParsePrefix(c.Server.IPv6), netip.MustParseAddr(p.IPv4))
+}
+
 // mapIPv6 puts the 32 bits of an IPv4 address into the low bits of the IPv6
 // network: 10.84.12.8 in fd11:5ee:bad:c0de::/64 becomes fd11:5ee:bad:c0de::a54:c08.
 func mapIPv6(v6net netip.Prefix, v4 netip.Addr) netip.Addr {