feat: add wireguard relay integration for public server access with End-to-End Encryption

Integrates tunwg (WireGuard tunnel) to enable optional public access
to the hapi server. Tunnel is disabled by default and enabled via
--relay flag or HAPI_TUNNEL=true environment variable.

Users can now run 'hapi server --relay' and get a direct link like:
https://app.hapi.run/?server=https://xxx.relay.hapi.run&token=xxx

.gitignore

@@ -8,6 +8,10 @@
 **/*.tsbuildinfo
 server/src/web/embeddedAssets.generated.ts
 
+# Downloaded tools (fetched at build time)
+server/tools/tunwg/tunwg-*
+server/tools/tunwg/*.exe
+
 # Env files (can contain secrets)
 **/.env
 **/.env.*