GHOSTWIRE 0.1.2: WireGuard server manager with web UI and API

Single Go binary that manages a WireGuard server based on pivpn's defaults:
- config.json as the single source of truth, reconciled to the kernel via
  netlink, wgctrl and its own nftables table (NAT, forward, input)
- web interface (dashboard, peers, peer detail, add peer, server, settings)
  and a JSON API for the future iOS app, with session and API-token auth
- client private keys are never stored; configs and QR codes shown once
- per-peer traffic statistics in stats.json, logs in GHOSTWIRE.jsonl
- HTTPS via Let's Encrypt, self-signed, certificate files or off
- self-managing: install, update (restores the old binary on failure),
  uninstall and passwd subcommands; systemd unit generated by the binary

Tested end to end on Ubuntu 26.04 (kernel 7.0) at dev.redetzke.aero.

Claude-Session: https://claude.ai/code/session_01RAnLbyQZ5ZTA7KqwXP98nw

web.go

@@ -0,0 +1,25 @@
+package main
+
+import (
+	"embed"
+	"net/http"
+)
+
+// The web UI is three static files built into the binary. It talks only to
+// /api/v1, the same API the iOS app uses.
+//
+//go:embed index.html app.js app.css
+var webFiles embed.FS
+
+func webHandler() http.Handler {
+	files := http.FileServerFS(webFiles)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/", "/app.js", "/app.css":
+			w.Header().Set("Cache-Control", "no-cache")
+			files.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}