feat: VPN / WireGuard inventory (Epic F read-first)

[ultimaterex]

Summary

• Parse all known *vpnClientProfiles / vpnProfiles families from fw-app init into a stable client_profiles catalog (plus awg_peers); keep legacy wg_clients with normalized status.
• Extend GET /v1/vpn with catalog fields and observatory provenance (init-primary; 404 when empty).
• Network tab: stacked VPN section under Local/WAN — peers, non-empty client families, VIP, virt WAN; hide empty families; Not in init empty state.

Type of change

• New feature

Test plan

• go test ./internal/fwapp/ ./internal/observatory/ ./internal/api/ -count=1 (hermetic fixture via local/fixtures/.../init.sanitized.json)
• npm run build in ui/
• Lab: warm fw-app init → Network shows WG peers + client profiles + VIP/virt WAN; SourceBadge fw-app-init
• Unpaired / no init → Network VPN shows Not in init
• Confirm no connect/disconnect controls

✅ Required (must be checked to merge)

• I have read the CONTRIBUTING.md.
• I have read and agree to the Contributor License Agreement (CLA).

Checklist

• My changes build: go vet / UI build clean for touched packages.
• Tests pass for touched packages; hermetic fixture parse + facade tests.
• No secrets committed.
• Docs: design/plan in local/superpowers (gitignored); no public API README change required for this slice.
• Focused Epic F read-first scope (no mutations / handshake streaming).

Notes for reviewers

Out of scope: connect/disconnect, force-via-VPN, tunnel create, live handshake streaming.
Spec: local/superpowers/specs/2026-08-26-vpn-wireguard-inventory-design.md