refactor: implement architecture review action plan

[tjjh89017]

Summary

Implements the prioritized refactor plan produced by an earlier architecture-review pass (tmp/arch-review/refactor-plan.md), which independently reviewed all 12 subsystems of this codebase and concluded the top-level shape is sound — this PR is a targeted repair series, not a re-architecture. All 35 items (34 planned + 1 discovered mid-loop) landed, were independently code-reviewed, and were spot-checked a second time via random sampling; every item passed both gates.

P0 — Correctness fixes (crash/interop risk)

• Guard crypto.Endpoint.Decrypt against short/malformed ciphertext (was a process-crashing panic on attacker/operator-controlled input)
• Join daemon worker goroutines before shutdown proceeds, so main's cleanup can no longer race a controller still using the WireGuard client (both the Run and RunOneshot code paths)
• Warn instead of silently dropping invalid/malformed peer public keys during config loading
• Fix the contrib Cloudflare exec plugin's double-hash bug (interop-breaking, see behavior change note below)

P1 — Structural/DI repairs

• Extract narrow, consumer-owned interfaces for PingMonitorController, plugin.Manager, and Daemon's four controller fields — closes the recurring pattern of concrete-type coupling that was blocking test coverage in several places
• Add a test seam to internal/wg/client_ctrl.go (the default WireGuard backend)
• Collapse byte-for-byte-duplicated Linux/Darwin-BSD STUN client code into a shared file
• Resolve the proxy.enabled per-interface vs. global-OR mismatch (chosen: option (a), per-device — see behavior notes)
• Fix mobile's plugin-traffic full-tunnel escape gap: corrected a false comment claiming the traffic was already protected, then implemented a real protected http.Transport for mobile's plugin manager

P2 — Test coverage

• Ping-monitor retry/backoff state machine, daemon signal/ticker/shutdown behavior, mobile package (previously zero coverage), BPF filter/payload-offset logic, STUN Read's error paths, wgproxy's Darwin/Windows escape watchers, repo.Devices/repo.Peers concurrency (-race), and script-level smoke tests for all 4 contrib plugins
• Extracted the shared endpoint-selection and STUN-discovery logic desktop and mobile had independently duplicated (and had already drifted) into one implementation both platforms now use — see behavior note below
• Added protocol whitelist validation to mobile's config parser, matching desktop's existing behavior

P3 — Hygiene / doc drift

• One cleanup pass per subsystem: ctrl, entity/repo, config, plugin, stun, wgproxy/routeprobe, composition root, crypto/logger, contrib, and CI/e2e config
• Added docs/architecture.md recording the recorded-but-undocumented patterns this review surfaced (narrow-interface style, why proxy wiring lives in main, the plugin registry's init() self-registration, etc.)

Discovered mid-loop: wire.go was missing several wire.Bind directives from earlier interface-extraction work, so go generate wire.go/the wire CLI's actual codegen path (go generate .) had been silently broken for a while — the already-committed wire_gen.go still worked via Go's structural typing, but regeneration would fail. Fixed; go generate . now succeeds cleanly with a no-op diff.

Externally-visible behavior changes (all deliberate, all called out in the plan)

• Invalid peer public keys: previously silently dropped, now logged as a warning (config loading still succeeds)
• Cloudflare exec plugin DNS record naming: fixed a double-hash bug that made this plugin incompatible with the builtin Cloudflare plugin and its own shell-script sibling. Existing deployments self-heal on the next publish cycle; see contrib/cloudflare/README.md's new compatibility note for the one-time re-publish/pin-old-binary options.
• Mobile config protocol validation: an unrecognized protocol string in mobile config now errors at parse time instead of being silently accepted (matches desktop's existing, documented behavior)
• Mobile dualstack discovery policy: mobile now uses desktop's "soft" warn-and-continue-on-partial-failure policy instead of its previous silent-both-empty check
• proxy.enabled: resolved as truly per-interface (option (a)) — a mixed config (one interface enabled, one not) now behaves as documented instead of collapsing to a global OR

No config-file-format changes, no plugin wire-protocol changes (exec JSON shape, shell variable protocol, pluginapi.Store all unchanged), no CLI flag changes.

Test plan

• Every item independently code-reviewed via a blind two-stage process (broad scan + deep verify), several with fixes applied and re-verified
• Every item spot-checked a second time via random sampling (5 consecutive clean batches)
• go build/go vet clean across linux/darwin/freebsd/windows throughout
• go test ./... passes (one pre-existing, unrelated sandbox network-permission failure in internal/plugin/dialer, confirmed present before this branch too)
• go generate . (Wire codegen) succeeds cleanly
• Full build-tag combination matrix verified for the plugin package ("", builtin_all, builtin_cloudflare, builtin_opendht, both together)
• Mobile package built/tested with -tags mobile

Additional minor behavior deltas surfaced by post-hoc review (all benign)

• Wrong-length-but-valid-base64 peer public keys: previously accepted with zero-padding/truncation (a broken identity), now dropped with a warning — stricter than the "warn instead of silent drop" item above states
• Ping monitor's startup delay is now cancellable by context, so daemon shutdown within the first ~10s no longer blocks on it (required by the new goroutine join)
• Logger falls back to info (was zerolog's trace default) on an unparseable level — unreachable via normal config loading, which rejects unknown levels first
• Two message-only string changes: proxy listen-port error now says "between 0 and 65535" (matching the actual check), and a STUN short-packet trace log was reworded