feat: add wireguard relay integration for public server access with End-to-End Encryption

Integrates tunwg (WireGuard tunnel) to enable optional public access
to the hapi server. Tunnel is disabled by default and enabled via
--relay flag or HAPI_TUNNEL=true environment variable.

Users can now run 'hapi server --relay' and get a direct link like:
https://app.hapi.run/?server=https://xxx.relay.hapi.run&token=xxx

server/package.json

@@ -20,12 +20,14 @@
         "grammy": "^1.38.4",
         "hono": "^4.11.2",
         "jose": "^6.1.3",
+        "qrcode": "^1.5.4",
         "socket.io": "^4.8.3",
         "web-push": "^3.6.7",
         "zod": "^4.2.1"
     },
     "devDependencies": {
         "@types/node": ">=25",
+        "@types/qrcode": "^1.5.6",
         "@types/web-push": "^3.6.4",
         "bun-types": "^1.3.5",
         "typescript": "^5"