Add per-subsystem config validation for wireguard, authelia, nftables, tunnel

- wireguard: ValidateConfig checks ListenPort range, Address/LanCIDR CIDR
  format. SaveConfig now validates before writing.
- authelia: ValidateConfigOpts checks required fields (Domain, JWTSecret,
  SessionSecret) and StorageEncKey minimum length (20 chars). GenerateConfig
  now validates before generating.
- nftables: ValidateWANInterface checks interface exists via net.InterfaceByName
  before generating rules that reference it.
- tunnel: ValidateConfig checks TunnelID, PublicDomain, GatewayDomain are set
  and credentials file exists. WriteConfig now validates before generating.

internal/wireguard/manager.go

@@ -103,8 +103,29 @@ func (m *Manager) GetConfig() (*Config, error) {
 	return &cfg, nil
 }
 
-// SaveConfig writes the server interface config.
+// ValidateConfig checks a WireGuard config for common errors before saving.
+func ValidateConfig(cfg *Config) error {
+	if cfg.ListenPort < 1 || cfg.ListenPort > 65535 {
+		return fmt.Errorf("listenPort must be 1-65535, got %d", cfg.ListenPort)
+	}
+	if cfg.Address != "" {
+		if _, _, err := net.ParseCIDR(cfg.Address); err != nil {
+			return fmt.Errorf("invalid server address CIDR %q: %w", cfg.Address, err)
+		}
+	}
+	if cfg.LanCIDR != "" {
+		if _, _, err := net.ParseCIDR(cfg.LanCIDR); err != nil {
+			return fmt.Errorf("invalid LAN CIDR %q: %w", cfg.LanCIDR, err)
+		}
+	}
+	return nil
+}
+
+// SaveConfig validates and writes the server interface config.
 func (m *Manager) SaveConfig(cfg *Config) error {
+	if err := ValidateConfig(cfg); err != nil {
+		return err
+	}
 	if err := os.MkdirAll(m.vpnDir(), 0755); err != nil {
 		return fmt.Errorf("create vpn dir: %w", err)
 	}