Add per-subsystem config validation for wireguard, authelia, nftables, tunnel

- wireguard: ValidateConfig checks ListenPort range, Address/LanCIDR CIDR
  format. SaveConfig now validates before writing.
- authelia: ValidateConfigOpts checks required fields (Domain, JWTSecret,
  SessionSecret) and StorageEncKey minimum length (20 chars). GenerateConfig
  now validates before generating.
- nftables: ValidateWANInterface checks interface exists via net.InterfaceByName
  before generating rules that reference it.
- tunnel: ValidateConfig checks TunnelID, PublicDomain, GatewayDomain are set
  and credentials file exists. WriteConfig now validates before generating.

internal/tunnel/manager.go

@@ -132,8 +132,32 @@ func (m *Manager) GenerateConfig(cfg Config, services []PublicDomain) string {
 	return string(data)
 }
 
-// WriteConfig generates and writes the cloudflared config to disk.
+// ValidateConfig checks tunnel config for common errors before generating.
+func ValidateConfig(cfg Config) error {
+	if !cfg.Enabled {
+		return nil // disabled is valid
+	}
+	if cfg.TunnelID == "" {
+		return fmt.Errorf("tunnel ID is required")
+	}
+	if cfg.PublicDomain == "" {
+		return fmt.Errorf("public domain is required")
+	}
+	if cfg.GatewayDomain == "" {
+		return fmt.Errorf("gateway domain is required")
+	}
+	credsFile := credentialsPath(cfg.CredentialsDir, cfg.TunnelID)
+	if _, err := os.Stat(credsFile); err != nil {
+		return fmt.Errorf("credentials file not found: %s", credsFile)
+	}
+	return nil
+}
+
+// WriteConfig validates, generates, and writes the cloudflared config to disk.
 func (m *Manager) WriteConfig(cfg Config, services []PublicDomain) error {
+	if err := ValidateConfig(cfg); err != nil {
+		return fmt.Errorf("config validation: %w", err)
+	}
 	content := m.GenerateConfig(cfg, services)
 	if content == "" {
 		// Remove config if tunnel is disabled or no public services