feat: standalone WireGuard from first install, fix networking stack

Standalone WireGuard (wg0:51820):
- New archipelago-wg.service creates wg0 independent of NostrVPN
- Keypair generated on first-boot, persisted on LUKS partition
- vpn.create-peer uses wg genkey/pubkey (no nvpn dependency)
- wg-address service depends on archipelago-wg, not nostr-vpn

Networking fixes:
- Remove nos.lol from default relays (requires PoW, events rejected)
- Add Tor hidden service for private relay (port 7777) — NAT'd peers
  can reach relay over Tor for NostrVPN signaling
- Fix Tor hostname sync race: wait loop before copying hostname files
- Add tor-hostnames + wireguard dirs to LUKS partition setup
- Include relay in hostname sync loops (setup-tor.sh + first-boot)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/archipelago/src/nostr_relays.rs

@@ -38,7 +38,7 @@ pub struct RelayStats {
 /// Default relays seeded on first use.
 const DEFAULT_RELAYS: &[&str] = &[
     "wss://relay.damus.io",
-    "wss://nos.lol",
+    "wss://relay.primal.net",
     "wss://relay.nostr.band",
     "wss://relay.snort.social",
     "wss://nostr.wine",
@@ -451,7 +451,7 @@ mod tests {
         let _ = load_relays(tmp.path()).await.unwrap();
 
         toggle_relay(tmp.path(), "wss://relay.damus.io", false).await.unwrap();
-        toggle_relay(tmp.path(), "wss://nos.lol", false).await.unwrap();
+        toggle_relay(tmp.path(), "wss://relay.primal.net", false).await.unwrap();
 
         let stats = get_stats(tmp.path()).await.unwrap();
         assert_eq!(stats.total_relays, DEFAULT_RELAYS.len());