Add optional AWG 3.0 protocol mode

[wiresock]

Summary

• preserve missing and legacy protocol state as AWG 2.0 without changing upgrades
• add explicit capability-gated AWG 3.0 enablement and an AWG 2.0 recovery path
• migrate the server and every recoverable client config with validation, locking, rollback, and signal recovery
• support AWG 3.0 client generation and confirmed protocol controls in the web panel
• add focused shell, privileged-helper, integration, and Rust coverage

Compatibility

AWG 2.0 remains the default for fresh installations and existing parameter files. AWG 3.0 is enabled only by an explicit administrator action after userspace and running-kernel readback succeeds. Because AWG 2.0 and 3.0 clients cannot share one interface, the migration refuses incomplete or unmanaged client state and updates all known copies together.

Validation

• Shell syntax and ShellCheck pass for the installer, privileged helper, and AWG 3.0 suite
• installer helper suite: 411 passed
• AWG protocol suite: 18 passed
• Rust web suite: 435 passed
• disposable Ubuntu 24.04 install, upgrade, helper, rollback, service-health, and uninstall integration passed

Closes #103