feat: automatically manage root VPN using wg-portal

[huytrinhm]

This PR adds the wg-portal integration for VPN users.

• Add libs/api/src/wg-portal.ts API client for:
  • listing peers by interface
  • preparing a new peer
  • creating a peer
  • updating a peer
  • deleting a peer
• Add apps/internal/src/vpn-sync/* module for syncing user VPN state to wg-portal using: username, vpnIpAddress, WireGuard key pair, active/disabled state
• Add schema hooks in libs/common-db/src/schemas/user.schema.ts to queue VPN sync jobs on user changes that may affect VPN state
• Add POST /users/vpn/sync-all to queue a full resync for all users
• Add wg_portal to docker-compose.yaml. The wg_portal container will manage the WireGuard interface on the host and expose the API for syncing peer state. The vpn-sync service will run a worker that processes the sync jobs and calls the wg-portal API.