feat(wireguard): accès distant au lab via VPN (Freebox 51820/udp → s01) (#80)

- rôle wireguard : serveur wg0 (10.99.0.0/24) sur storage-01, profils
  clients générés dans /etc/wireguard/clients/ (fichier .conf / QR code)
- gateway : filtrage nftables par pair — full (tout le lab) / portal
  (uniquement Traefik :80 = portail Guacamole), masquerade VPN→cluster
- dnsmasq : bind-dynamic + écoute wg0 → *.lab.local résolu dans le tunnel
- pairs initiaux : alkatrazz (full), invite-01 (portal)
- vault : clés WireGuard + reprise de l'archive Authentik (remplace #78)
- doc : admin/infra/wireguard.md (onboarding pair, pièges, exploitation)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

ansible/roles/wireguard/tasks/main.yml

@@ -0,0 +1,42 @@
+---
+- name: Install wireguard-tools
+  ansible.builtin.dnf:
+    name: wireguard-tools
+    state: present
+
+- name: Deploy wg0 server config
+  ansible.builtin.template:
+    src: wg0.conf.j2
+    dest: "/etc/wireguard/{{ wireguard_interface }}.conf"
+    owner: root
+    group: root
+    mode: '0600'
+  notify: Restart wireguard
+
+- name: Create clients config directory
+  ansible.builtin.file:
+    path: /etc/wireguard/clients
+    state: directory
+    owner: root
+    group: root
+    mode: '0700'
+
+# Profils clients prêts à distribuer (fichier .conf à envoyer / QR code —
+# voir admin/infra/wireguard.md)
+- name: Generate client configs
+  ansible.builtin.template:
+    src: client.conf.j2
+    dest: "/etc/wireguard/clients/{{ item.name }}.conf"
+    owner: root
+    group: root
+    mode: '0600'
+  loop: "{{ wireguard_peers }}"
+  loop_control:
+    label: "{{ item.name }}"
+  no_log: true
+
+- name: Enable and start wg-quick
+  ansible.builtin.systemd:
+    name: "wg-quick@{{ wireguard_interface }}"
+    enabled: true
+    state: started