feat: vprox edge adds support for edge connectors

[luiscape]

vprox edge deploys an outbound-only connector inside a restricted network that establishes a WireGuard tunnel back to the vprox server. It advertises local CIDR routes (via --routes) so that connect clients can reach private resources (databases, internal APIs, etc.) through the server — without opening any inbound ports in the restricted network.

[Copilot]

Pull request overview

This PR introduces edge connectors to vprox, enabling an outbound-only node inside a restricted/private network to establish a WireGuard tunnel back to the vprox server and advertise reachable CIDR routes so connect clients can access private resources through the server.

Changes:

• Adds a new vprox edge CLI command and corresponding edge client implementation (WireGuard + forwarding/NAT).
• Extends the server HTTPS control plane with /edge-connect and /edge-disconnect endpoints and route advertisement conflict handling.
• Updates documentation to explain the edge connector architecture, setup steps, and requirements.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
README.md	Documents edge connector concept, architecture diagram, setup steps, and feature list update.
main.go	Registers the new edge subcommand with the root CLI.
lib/server.go	Adds edge peer tracking, route conflict checking, new edge connect/disconnect handlers, and tightens SNAT rule matching by outbound iface.
lib/edge.go	Implements the edge connector client: control-plane calls, WireGuard config, forwarding + iptables NAT rules, and tunnel health checks.
cmd/edge.go	Adds the vprox edge CLI wiring: route parsing, lifecycle management, and reconnect/healthcheck loop.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.