feat(tunnel): phase 1 — ipstack datapath + forwarder

Wire the WireGuard transport to a real network. `WgDevice` is a zero-alloc
AsyncRead+AsyncWrite packet device: it owns the UDP socket and WgTunnel and
does decapsulate/encapsulate inline against a reused buffer in poll_read/
poll_write (no channels, no Arc<Mutex>, no per-packet allocation). The endpoint
drives ipstack over the device and forwards each guest flow to a real socket —
TCP via copy_bidirectional, UDP via a datagram relay; the forward destination
is the stream's peer_addr (confirmed = dst_addr from ipstack source).

- Add tokio `net` feature, ipstack 1.0 dependency, etherparse (dev)
- Document the datapath decisions in TUNNEL.md

Tests: 90 lib total (+1). A loopback integration test stands up the real
WgDevice + ipstack over two localhost UDP sockets, drives an actual WireGuard
handshake from a bare guest tunnel, sends an etherparse-built IPv4/UDP packet,
and asserts ipstack surfaces a stream addressed to the packet's destination —
validating the whole receive datapath without a container.

Author: tomchuk

Cargo.lock

@@ -25,6 +25,7 @@ tokio              = { version = "1", features = [
     "io-util",
     "io-std",
     "fs",
+    "net",
     "sync",
     "signal",
     "time",
@@ -59,9 +60,11 @@ tempfile           = "3"
 boringtun = { version = "0.7", default-features = false }
 base64 = "0.22"
 getrandom = "0.4.2"
+ipstack = "1.0.0"
 
 [dev-dependencies]
 assert_cmd         = "2"
+etherparse = "0.19"
 predicates         = "3"
 
 [features]