Add per-subsystem config validation for wireguard, authelia, nftables, tunnel

- wireguard: ValidateConfig checks ListenPort range, Address/LanCIDR CIDR
  format. SaveConfig now validates before writing.
- authelia: ValidateConfigOpts checks required fields (Domain, JWTSecret,
  SessionSecret) and StorageEncKey minimum length (20 chars). GenerateConfig
  now validates before generating.
- nftables: ValidateWANInterface checks interface exists via net.InterfaceByName
  before generating rules that reference it.
- tunnel: ValidateConfig checks TunnelID, PublicDomain, GatewayDomain are set
  and credentials file exists. WriteConfig now validates before generating.

internal/authelia/config.go

@@ -32,8 +32,28 @@ type ConfigOpts struct {
 	SMTPPassword   string       // SMTP password (from secrets)
 }
 
-// GenerateConfig builds Authelia's configuration.yml and writes it atomically.
+// ValidateConfigOpts checks that required fields are present and valid.
+func ValidateConfigOpts(opts ConfigOpts) error {
+	if opts.Domain == "" {
+		return fmt.Errorf("auth portal domain is required")
+	}
+	if opts.JWTSecret == "" {
+		return fmt.Errorf("JWT secret is required")
+	}
+	if opts.SessionSecret == "" {
+		return fmt.Errorf("session secret is required")
+	}
+	if len(opts.StorageEncKey) < 20 {
+		return fmt.Errorf("storage encryption key must be at least 20 characters, got %d", len(opts.StorageEncKey))
+	}
+	return nil
+}
+
+// GenerateConfig validates options, builds Authelia's configuration.yml, and writes it atomically.
 func (m *Manager) GenerateConfig(opts ConfigOpts) error {
+	if err := ValidateConfigOpts(opts); err != nil {
+		return fmt.Errorf("config validation: %w", err)
+	}
 	if err := m.EnsureDataDir(); err != nil {
 		return err
 	}